We help IT Professionals succeed at work.

Find enabled users in a OU

Indie101
Indie101 asked
on
3,142 Views
Last Modified: 2018-12-14
Lets just say I need to check for enabled users in an OU where all users should be disabled, trying the below without success

Terminated Users OU is nested inside Disabled Objects OU

Get-ADUser -Filter * -SearchBase "OU=Disabled Objects,OU=Terminated Users,DC=test,DC=com" -Properties Name, sAMAccountName, Enabled | ? {$_Enabled -eq $true} | select Name, sAMAccountName, Enabled | Export-csv "c:\disabledusers.csv" -NoTypeInformation

I get the below error, does this guarantee that no enabled users exist , or should it return something else

Get-ADUser : Directory object not found
At line:1 char:1
+ Get-ADUser -Filter * -SearchBase "OU=Disabled Objects,OU=Terminated U ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (:) [Get-ADUser], ADIdentityNotFoundException
    + FullyQualifiedErrorId : ActiveDirectoryCmdlet:Microsoft.ActiveDirectory.Management.ADIdentityNotFoundException,Microsoft.ActiveDirectory.Management.Commands.GetAD
   User
Comment
Watch Question

Patrick BogersDatacenter platform engineer Lindows
CERTIFIED EXPERT

Commented:
Hi

Did you import the active directory module?

Cheers

Author

Commented:
Yes I should have pointed that out, working away for other scripts

RSAT is installed etc
Lee IngallsDirector of IT/TS, Quality and Finance

Commented:
Check to see if you have the activedirectory module...
get-module -listavailable

import it...
import-module activedirectory
Patrick BogersDatacenter platform engineer Lindows
CERTIFIED EXPERT

Commented:
Ok module is loaded, did you run the script on a DC?

Next, did you check in adsiedit the path is correct?
OU=Disabled Objects,OU=Terminated Users,DC=test,DC=com

Author

Commented:
@Lee Yes its imported thanks

@Patrick I will check adsiedit that is the domain (not exactly obviously but same naming convention) and I am running on a DC , RSAT installed
Patrick BogersDatacenter platform engineer Lindows
CERTIFIED EXPERT

Commented:
Ok Thanks for checking. I am hoping your real naming convention do NOT hold spaces in OUs, just as a save and best practise.

Author

Commented:
I haven't tried it without spaces, I tried it before for one word OU's could it be the spaces?
Patrick BogersDatacenter platform engineer Lindows
CERTIFIED EXPERT

Commented:
It depends the path indicated by adsiedit.

Author

Commented:
Switched it around as in adsiedit it gives OU=Terminated Users,OU=Disabled Users,DC=test,DC=com as DN for OU=Terminated Users

Get same error

Get-ADUser : Directory object not found
At line:1 char:1
+ Get-ADUser -Filter * -SearchBase "OU=Terminated Users,OU=Disabled Use ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (:) [Get-ADUser], ADIdentityNotFoundException
    + FullyQualifiedErrorId : ActiveDirectoryCmdlet:Microsoft.ActiveDirectory.Management.ADIdentityNotFoundException,Microsoft.ActiveDirectory.Management.Commands.GetAD
   User
Patrick BogersDatacenter platform engineer Lindows
CERTIFIED EXPERT

Commented:
Could you, just to be sure, import the active directory module. Line1 char1 is bugging me.

Author

Commented:
Sure Patrick, enclosing screenshot, after using get-module -listavailable (and importing module for AD again)
AD-module.JPG
CERTIFIED EXPERT
Top Expert 2014
Commented:
Unlock this solution and get a sample of our free trial.
(No credit card required)
UNLOCK SOLUTION

Author

Commented:
Thanks footech, I have run the command

Get-ADOrganizationalUnit "OU=Terminated Users,OU=Disabled Users,DC=test,DC=com"

Get-ADOrganizationalUnit : Directory object not found

I will have to check ADSIEDIT or with some of the inhouse guys here

Author

Commented:
Added identity parameter to it same result, cannot find object

Get-ADOrganizationalUnit -Identity "OU=Terminated Users,OU=Disabled Users,DC=test,DC=com
Chris DentPowerShell Developer
CERTIFIED EXPERT
Top Expert 2010
Commented:
Unlock this solution and get a sample of our free trial.
(No credit card required)
UNLOCK SOLUTION
Commented:
Unlock this solution and get a sample of our free trial.
(No credit card required)
UNLOCK SOLUTION
CERTIFIED EXPERT
Top Expert 2014
Commented:
Unlock this solution and get a sample of our free trial.
(No credit card required)
UNLOCK SOLUTION
Chris DentPowerShell Developer
CERTIFIED EXPERT
Top Expert 2010
Commented:
Unlock this solution and get a sample of our free trial.
(No credit card required)
UNLOCK SOLUTION
CERTIFIED EXPERT
Top Expert 2014

Commented:
Are you copying and pasting the DN?  Just trying to make sure the error isn't due to a mistype or misread.

Author

Commented:
Apologies (jeez I had disabled users) I used objects instead and received a blank csv and works fine

I'm taking it that the blank csv corresponds to it correctly?

Thanks footech and chris and lee

Author

Commented:
is this 100% certain that no enabled users in Terminated Users?
Chris DentPowerShell Developer
CERTIFIED EXPERT
Top Expert 2010

Commented:
Yes. This line returns all enabled users in the OU (and all sub-OUs).
Get-ADUser -Filter { Enabled -eq $true } -SearchBase "OU=Terminated Users,OU=Disabled Objects,DC=test,DC=com"

Open in new window

And I guess that's similar to your current script. So if it returns nothing there are none, the comparison is a simple one (in AD terms).
CERTIFIED EXPERT
Top Expert 2014
Commented:
Unlock this solution and get a sample of our free trial.
(No credit card required)
UNLOCK SOLUTION

Author

Commented:
Awesome thanks guys :)
Unlock the solution to this question.
Thanks for using Experts Exchange.

Please provide your email to receive a sample view!

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.