get-aduser -filter enabled -eq true not working

Posted by MaTOntes@reddit | sysadmin | View on Reddit | 16 comments

Has something changed with how AD stores and marks users as disabled? The below script returns this user even though they are definitely disabled. I'm just trying to get a list of all enabled users for a different task. It seems in my environment the "Enabled -eq 'true' " filter doesn't work where in the past I know it's worked as expected. Get-ADUser -filter 'DisplayName -eq "joe blogs" -and Enabled -eq "True" '

Reply to Post

16 Comments

[-]

TantoThunder@reddit

You need to run the script elevated I believe.

[-]

MaTOntes@reddit (OP)

DING DING DING!!! Winner! Also.. what the fuck. Querying on Enabled -eq $true only works if you're running admin?!? And doesn't return an error if you're not? Madness!

[-]

anonymousITCoward@reddit

Don't use PS in ISE, just run it on it's own.

[-]

AppIdentityGuy@reddit

Can you show us the code you are using? I agree with the other posters here. This query never requires either an admin account or an elevated PoSH session to run. At least not in my experience...

[-]

progenyofeniac@reddit

That’s absolutely not the issue. I run ‘enabled’ queries all day every day from my non elevated account. Not saying it didn’t resolve the issue, but if it did it’s a side effect of running it elevated, such as hitting a different domain controller or something else.

[-]

spoonplaysgames@reddit

try -eq $true

[-]

MaTOntes@reddit (OP)

>Get-ADUser -filter 'DisplayName -eq "joe blogs" -and Enabled -eq "True" ' Same result. See pic below. User is disabled, but still appears in results.  https://preview.redd.it/nund8st9e8qa1.jpeg?width=822&format=pjpg&auto=webp&v=enabled&s=49a6d31cb4010d334c3ba9c2b041e5634ed4921f

[-]

spoonplaysgames@reddit

my thinking is that you’re going to return this user because you’re filtering them by name. i cant think of a specific use case where you’d filter based on name and enabled status. more likely you’d get-aduser -identity and select enabled or -property enabled to get their status.

[-]

MaTOntes@reddit (OP)

I was just testing the Enabled -eq $true bit. My real query is just selecting all enabled users from an OU but it returns \~900 users when it should only return 250ish. Thus the creation of the troubleshooting query in this post

[-]

spoonplaysgames@reddit

got it. in that case i recommend: https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-aduser?view=windowsserver2022-ps

[-]

MaTOntes@reddit (OP)

Thanks for your help. u/TantoThunder worked it out. Needed an elevated session for some reason.

[-]

spoonplaysgames@reddit

get-aduser absolutely doesnt need elevated permissions. by default, all users in the domain can read the domain, including the enabled property. glad it worked for you, but unless your domain has wild delegated permissions going on, that’s not what did it.

[-]

MaTOntes@reddit (OP)

Well I don't know what to tell you. Running non-elevated returns all users and seems to ignore the enabled attribute. Running elevated returns correct results. I'd be interested to see if other people see the same behaviour if what you're saying is true.

[-]

get-aduser -filter enabled -eq true not working

Reply to Post

16 Comments

TantoThunder@reddit

MaTOntes@reddit (OP)

anonymousITCoward@reddit

AppIdentityGuy@reddit

progenyofeniac@reddit

spoonplaysgames@reddit

MaTOntes@reddit (OP)

spoonplaysgames@reddit

MaTOntes@reddit (OP)

spoonplaysgames@reddit

MaTOntes@reddit (OP)

spoonplaysgames@reddit

MaTOntes@reddit (OP)

BlackV@reddit

Nezgar@reddit

One-Environment2197@reddit