Let's say that in your organization, that you always set the Department attribute to match the department that users work in. This could be required for dynamic groups or address books. You've just created 100 new users, but forgot to configure the department. You need to make a query for all of the users without a department configured.
My first attempt was this:
Get-ADUser -Filter {company -eq $null}
However, this generates an error. You can't use $null in a filter.
What finally worked was this:
Get-ADUser -Filter {company -notlike "*"}
The gets a list of users where the company attribute is not like anything.
I should also note that if you try to query for not equal (-ne) then it will skip $null values when comparing. The above example is the only way that I know of to get $null values.
Update Apr 2017:
A quick note that the corollary of the above is that when you want to query objects with any value set, you can filter for -like "*". I recently used this in a script where I only wanted users with values in the proxyAddresses property that I wanted to copy to the UPN.
You saved my day, pal. Thank you!
ReplyDeleteAnother thanks; not at all intuitive that -ne *skips* null values.
ReplyDeleteThank you!
ReplyDeleteThanks!
ReplyDeletethe -LDAPFilter also gets around this :)
ReplyDeleteweird one but saved me some time trying to figure out why this wasn't working. Thanks!!
ReplyDeleteyour post is still relavant
ReplyDeleteThank you...
ReplyDeletegood stuff thanks!
ReplyDeleteThanks..
ReplyDeleteThanks man, so simple but was banging my head trying to figure it out!
ReplyDeleteYes, TY!!!
ReplyDeleteThanks. Great help!
ReplyDelete:) Thumbs up on this one
ReplyDeleteThanks man.
ReplyDeleteGotta love Microsoft...
thanks man!
ReplyDeleteUnfortunately, this doesn't work with extended attributes, such as "manager". You get the following error: The following: ''Eq', 'Ne'' are the only operator(s) supported for searching on extended
ReplyDeleteattribute: 'Manager'.
Kinda ugly, but maybe dump the whole set of users into a variable and then you can evaluate with Where-Object. Terribly inefficient, but might work.
DeleteIf searching for extended attributes, you can use LDAPFilter, I managed to look for empty Managers by using
ReplyDeleteget-ADuser -ldapfilter "(!Manager=*)"
(and using -searchbase to check real users, of course.)
even in 2021 still saving a panicked apprentice! thx a lot for the pointer!
ReplyDeleteStill great, especially in 2021! Thank you very much.
ReplyDelete