active directory

Posted on 2016-10-24
Last Modified: 2016-10-24
PS C:\UsersUSERXXX> get-aduser -filter {objectclass -like "user"} | Measure-Object

I  just ran above  count on objectclass like “user” and it returned 8531 objects

and I ran Get-ADObject -Filter {name -like '*'} -SearchBase 'CN=Schema,CN=Configuration,DC=Fabrikam,DC=COM' -ResultSetSize $null | Measure-Object  and it gave 2786 objects

so what is the difference between those 2
Question by:pramod1
  • 5
  • 2
  • 2
LVL 22

Expert Comment

by:Joseph Moody
ID: 41857295
The first one is only getting objects which are users. The second is getting every object in AD but only under the schema container.

Author Comment

ID: 41857299
so the 1st one is getting all users  who are contacts users and users in domain who re also in schema?

and 2nd one is pulling users from only schema ? can you elaborate

Author Comment

ID: 41857304
I mean all objects are in schema
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.


Author Comment

ID: 41857332
so from where other objects are being pulled in 1st command
LVL 22

Expert Comment

by:Joseph Moody
ID: 41857338
everywhere in the first command. It doesn't have a searchbase parameter so it searches the entire domain.

Author Comment

ID: 41857354
I still didn't get it

1st command searches entire domain -that is fine

but the 2nd command searches users in schema only but all users I think are in schema>
LVL 40

Expert Comment

ID: 41857391
First command gives count of user objects for entire domain. Also Get-ADuser list only user objects so using -filter {objectclass -like "user"} will not do anything.

Second command lists all objects under 'CN=Schema' container, it does not contain any users objects. Schema container stores class and attribute definitions for all existing and possible Active Directory objects.
Ref :

To get user count using Get-ADObject, Try..
Get-ADObject -Filter {ObjectClass -eq "user" -and ObjectCategory -eq "Person"} | Measure

Open in new window


Author Comment

ID: 41857431
1) Get-ADObject -Filter * -this pulled 16421 user objects
2)get-aduser -filter {objectclass -like "user"} | Measure-Object-  thsi pulled 8531 user objects
3) ADObject -Filter {name -like '*'} -SearchBase 'CN=Schema,CN=Configuration,DC=Fabrikam,DC=COM' -ResultSetSize $null | Measure-Object  -2786 objects

2nd one gave all user objects in domain-8531 user objects
3rd one gave all objects and attributes -2786 user objects in schema container

so how come 1st one gave -16421?
LVL 40

Accepted Solution

Subsun earned 500 total points
ID: 41857450
First command lists all objects not just users object..

Second command list just user objects..

Third command doesn't list any users objects, it lists the objects contains in schema container as I explained in my previous comment.

Hope it's clear..

Featured Post

Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
add group policy for windows 10 users 3 45
WMI Setup on Server 2012 and 2008 GPO 1 29
Old Active Directory sync to Azure 3 23
Cannot access RDP (AD 2012) 6 18
Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
This script can help you clean up your user profile database by comparing profiles to Active Directory users in a particular OU, and removing the profiles that don't match.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…

856 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question