Avatar of Tessando
Tessando
Flag for United States of America asked on

Powershell Script Question for Get-ADUser to Pull only from Specific Organizational Unit (OU)

I want to put the script listed on this page into Production. 


In the commentary, the writer says "You could customize this search many ways. Two examples would be to target a specific organizational unit (OU) or maybe a set of accounts that match a name (such as admin accounts)."


I would like to have this script pull only from the Organizational Unit "Users-Groups/Users".


How can I have this line pull only from the Organizational Unit "Users-Groups/Users"?


Get-ADUser -filter {Enabled -eq $True -and PasswordNeverExpires -eq $False ‑and PasswordLastSet -gt 0}

Open in new window


Thanks for your help!

PowershellActive Directory

Avatar of undefined
Last Comment
Tessando

8/22/2022 - Mon
oBdA

You need the "Distinguished Name"; for your example, that would be something like "OU=Users,OU=Users-Groups,DC=your,DC=domain,dc=com". The parameter is "SearchBase".
Get-ADUser -filter {Enabled -eq $True -and PasswordNeverExpires -eq $False ‑and PasswordLastSet -gt 0} -SearchBase "OU=Users,OU=Users-Groups,DC=your,DC=domain,dc=com"

Open in new window

This has examples for the search base:
Get-ADUser
https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduser?view=windowsserver2016-ps

If in doubt, you can always get the DN by using the ADUC console; enable the Advanced View, open the properties of the object, go to the "Attributes" tab, and check/copy the distinguishedName attribute.
DEMAN-BARCELO (MVP) Thierry

Hi,

I will just add an option/parameter to the solution of oBda:

with the option "-SearchScope" and the parameter "Base" ,  you can choose to search only in the OU indicated but not in sub-OUs.
Note that the parameter can also be "Subtree" for all sub-OU or "OneLevel".
Tessando

ASKER
@oBda: Thank you for the fast and accurate response. I appreciate that. 
I'm getting the following error in Powershell:

Get-ADUser : Cannot convert 'System.Object[]' to the type 'System.String' required by parameter 'SearchBase'. Specified method is not supported.

Open in new window


Is there a reason why this method wouldn't be supported?

@DEMAN-BARCELO (MVP) Thierry

When I look at the properties of the OU in Active Directory, I see the following Canonical Name:
companyname.org/companyorg/Users-Groups/Users

Therefore I'm using this as the line in the Powershell script:
"OU=Users,OU=Users-Groups,DC=companyorg,DC=companyname,dc=org"

Is this considered a sub-OU? This is the given OU that I'd like to run this script on.

Thanks for all your help!


I started with Experts Exchange in 2004 and it's been a mainstay of my professional computing life since. It helped me launch a career as a programmer / Oracle data analyst
William Peck
oBdA

Seems like you didn't put quotes around the DN.
Powershell then treats the commas as array element separator and assumes you're passing multiple strings.
And if the canonical name is "companyname.org/companyorg/Users-Groups/Users", then the DN is "OU=Users,OU=Users-Groups,OU=companyorg,DC=companyname,DC=org".
"DC" is "Domain Component", so that's the DNS part.
DEMAN-BARCELO (MVP) Thierry

Yes, "OU=Users,OU=Users-Groups,DC=companyorg,DC=companyname,dc=org" is a sub-OU.

But, it can be the parameter of "searchbase". It means the start of your search.

Now, if this (sub-)OU contains other sub-Ous, you can choose to do the search in all this hierarchy or not.
Tessando

ASKER
I did have one "DC" listed as an "OU". Thanks for the sanity check, oBda.

Where I'm scratching my head is that Powershell is saying the error is occurring at ..."*.ps1:25 char:125

Here is the exact line pasted (via the Powershell IDE) directly into EE:

$users = Get-ADUser -filter {Enabled -eq $True -and PasswordNeverExpires -eq $False ‑and PasswordLastSet -gt 0} -SearchBase "OU=Users,OU=Users-Groups,OU=*****org,DC=********,DC=org", `

Open in new window


Question 1: Do spaces count as characters?
Question 2: Is the character " not being recognized by Powershell? If so, is there an alternative I can use?

Thank you for your help today. I greatly appreciate it.

⚡ FREE TRIAL OFFER
Try out a week of full access for free.
Find out why thousands trust the EE community with their toughest problems.
ASKER CERTIFIED SOLUTION
oBdA

THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
GET A PERSONALIZED SOLUTION
Ask your own question & get feedback from real experts
Find out why thousands trust the EE community with their toughest problems.
Tessando

ASKER
Thank you, that solved the issue of pulling from a specific OU. I'm hitting another challenge, but it's with the script and out of the context of this question. Thank you so much for the guidance! I appreciate your help.

Happy Holidays!