get-aduser -filter doesn't show users in OUs and SubOUs

hi friends

in active directory, in default "users" container, have created group named "helpdesks".

i have ous , subous each contains users.

i need users in entire domain not member of helpdesks group.

get-aduser -searchbase -filter {memberof -notlike  'cn=helpdesks,cn=users,dc=mydomain,dc=lab' } | select name  get-aduser -searchbase 'dc=mydomain,dc=lab' -searchscope subtree -filter {memberof -notlike  'cn=helpdesks,cn=users,dc=mydomain,dc=lab' } | select name

but commands only these 3 accounts : administrator , guest , krbtgt

( , not accounts in ou-users , users-marketing subou & other locations )

strange !

any idea

thanks in advanced

the problem membership in "primary" group, "domain users", not included in memberof attribute of user. memberof attribute of user no group memberships except "domain users" will empty. way ad works, if attribute has no values, not saved in database. filter use only considers users @ least 1 membership in addition "domain users" (so users have memberof attribute).

the solution add clause user must either not have the specified group in memberof collection, or attribute has no values (is missing). try:

get-aduser -filter {memberof -notlike  "cn=helpdesks,cn=users,dc=mydomain,dc=lab" -or memberof -notlike "*"} | select name

yes, your ldap syntax filter works.

---

richard mueller - mvp directory services

Windows Server  >  Windows PowerShell