Vista - Exclude lines that include string

I'm trying to get a list of all users in AD except ones in OUs "foo"
and "fum", while also excluding disabled accounts. I'm having two
problems with this. I'll try and explain:

I'm getting the full list of users with:

dsquery user -limit 0

This produces output like the following but includes disabled accounts
and some oddball OUs and CNs that shouldn't really be included for
processing which need to be excluded from the output.

"CN=billgates,OU=Users,Disabled Accounts,DC=microsoft,DC=com"
"CN=melinda,OU=Users,OU=Disabled Accounts,DC=microsoft,DC=com"
"CN=billskid,OU=Users,OU=Development,DC=microsoft,DC=com"

I tried separating the disabled accounts out first (actual disabled
accounts, don't confuse with the OU=Disabled Accounts) with a:

compare-object $(dsquery user -limit 0) $(dsquery user -disabled
-limit 0) -passThru | where-object {$_.SideIndicator -eq "<="}

but that doesn't seem to work -- I've done this with a diff converted
from unix and that works properly, but where-object doesn't seem to
compare the lines as well. I end up with lots of disabled users in
there anyhow.

That's the first problem. Also, I need to exclude a few OUs from this
list. So, how can I take the above output and filter out lines that
include strings like "OU=Disabled" and "CN=Microsoft Exchange System
Objects"? This can't be done in the object model, right? Doesn't it
have to be done with strings? I can't figure out how to do that in a
PSH way (I could do it with grep, sed, etc.).

If I should be querying AD differently, great, but my understanding is
that wasn't included in PSH yet.

Thank You

bh

Powershell actually has relatively good AD support built in through ADSI. As with all things Powershell, you can use the built in ways or any .NET ways available.

If you want a list of all objects in a given OU:

$g = [adsi]LDAP://OU=SpecificOU,DC=domain,DC=com
$g.psbase.get_children()

This returns groups, users, computers... anything under that OU. Personally I perfer to start with a .NET directorysearcher object and work from that...


$ldapQuery = "(&(objectCategory=person)(objectClass=user))"
$de = new-object system.directoryservices.directoryentry -argumentlist "LDAP://OU=SpecificOU,DC=domainDC=com"
$ads = new-object system.directoryservices.directorysearcher -argumentlist $de,$ldapQuery
$g = $ads.findall()

This will return only objects with ObjectCategory = person and ObjectClass = user. If you want to further filter that to exclude disabled users, change $ldapQuery to:

$ldapQuery = "(&(objectCategory=person)(objectClass=user)(!userAccountControl:1.2.840.113556.1.4.803:=2))"
$de = new-object system.directoryservices.directoryentry -argumentlist "LDAP://OU=SpecificOU,DC=domainDC=com"
$ads = new-object system.directoryservices.directorysearcher -argumentlist $de,$ldapQuery
$g = $ads.findall()

Now you have just a list of non-disabled users. The one thing to keep in mind is that this is simply a SearchResult. If you want access to the *actual* directory entry you can do the following:

$direntry = [adsi]$g[0].path

You can see what methods and properties are available using

$direntry | gm



--

gaurhoth
http://gaurhothw.spaces.live.com/


"Brian Hoort" <brian.hoort@gmail.com> wrote in message news:1168536313.635590.217720@i56g2000hsf.googlegroups.com...
> I'm trying to get a list of all users in AD except ones in OUs "foo"
> and "fum", while also excluding disabled accounts. I'm having two
> problems with this. I'll try and explain:
>
> I'm getting the full list of users with:
>
> dsquery user -limit 0
>
> This produces output like the following but includes disabled accounts
> and some oddball OUs and CNs that shouldn't really be included for
> processing which need to be excluded from the output.
>
> "CN=billgates,OU=Users,Disabled Accounts,DC=microsoft,DC=com"
> "CN=melinda,OU=Users,OU=Disabled Accounts,DC=microsoft,DC=com"
> "CN=billskid,OU=Users,OU=Development,DC=microsoft,DC=com"
>
> I tried separating the disabled accounts out first (actual disabled
> accounts, don't confuse with the OU=Disabled Accounts) with a:
>
> compare-object $(dsquery user -limit 0) $(dsquery user -disabled
> -limit 0) -passThru | where-object {$_.SideIndicator -eq "<="}
>
> but that doesn't seem to work -- I've done this with a diff converted
> from unix and that works properly, but where-object doesn't seem to
> compare the lines as well. I end up with lots of disabled users in
> there anyhow.
>
> That's the first problem. Also, I need to exclude a few OUs from this
> list. So, how can I take the above output and filter out lines that
> include strings like "OU=Disabled" and "CN=Microsoft Exchange System
> Objects"? This can't be done in the object model, right? Doesn't it
> have to be done with strings? I can't figure out how to do that in a
> PSH way (I could do it with grep, sed, etc.).
>
> If I should be querying AD differently, great, but my understanding is
> that wasn't included in PSH yet.
>
> Thank You
>
> bh
>

If each entry is in a separate line something like this should work...

dsquery user -limit 0 | where { $_ -notmatch 'Disabled Accounts' }

or:

@(dsquery user -limit 0) -notmatch 'Disabled Accounts' -notmatch
'CN=Microsoft Exchange System Objects'


"Brian Hoort" <brian.hoort@gmail.com> wrote in message
news:1168536313.635590.217720@i56g2000hsf.googlegroups.com...
> I'm trying to get a list of all users in AD except ones in OUs "foo"
> and "fum", while also excluding disabled accounts. I'm having two
> problems with this. I'll try and explain:
>
> I'm getting the full list of users with:
>
> dsquery user -limit 0
>
> This produces output like the following but includes disabled accounts
> and some oddball OUs and CNs that shouldn't really be included for
> processing which need to be excluded from the output.
>
> "CN=billgates,OU=Users,Disabled Accounts,DC=microsoft,DC=com"
> "CN=melinda,OU=Users,OU=Disabled Accounts,DC=microsoft,DC=com"
> "CN=billskid,OU=Users,OU=Development,DC=microsoft,DC=com"
>
> I tried separating the disabled accounts out first (actual disabled
> accounts, don't confuse with the OU=Disabled Accounts) with a:
>
> compare-object $(dsquery user -limit 0) $(dsquery user -disabled
> -limit 0) -passThru | where-object {$_.SideIndicator -eq "<="}
>
> but that doesn't seem to work -- I've done this with a diff converted
> from unix and that works properly, but where-object doesn't seem to
> compare the lines as well. I end up with lots of disabled users in
> there anyhow.
>
> That's the first problem. Also, I need to exclude a few OUs from this
> list. So, how can I take the above output and filter out lines that
> include strings like "OU=Disabled" and "CN=Microsoft Exchange System
> Objects"? This can't be done in the object model, right? Doesn't it
> have to be done with strings? I can't figure out how to do that in a
> PSH way (I could do it with grep, sed, etc.).
>
> If I should be querying AD differently, great, but my understanding is
> that wasn't included in PSH yet.
>
> Thank You
>
> bh
>

Both of these solutions are very educational and helpful, Thank You
gentlemen.

In the second solution, the @ doesn't seem necessary. For the benefit
of everyone here, is there a reason to do it? What benefits are there
to using it?

bh

On Jan 12, 11:58 pm, "Marcel J. Ortiz [MSFT]"
<mos...@online.microsoft.com> wrote:
> If each entry is in a separate line something like this should work...
>
> dsquery user -limit 0 | where { $_ -notmatch 'Disabled Accounts' }
>
> or:
>
> @(dsquery user -limit 0) -notmatch 'Disabled Accounts' -notmatch
> 'CN=Microsoft Exchange System Objects'
>
> "Brian Hoort" <brian.ho...@gmail.com> wrote in messagenews:1168536313.635590.217720@i56g2000hsf.googlegroups.com...
>
>
>
> > I'm trying to get a list of all users in AD except ones in OUs "foo"
> > and "fum", while also excluding disabled accounts. I'm having two
> > problems with this. I'll try and explain:
>
> > I'm getting the full list of users with:
>
> > dsquery user -limit 0
>
> > This produces output like the following but includes disabled accounts
> > and some oddball OUs and CNs that shouldn't really be included for
> > processing which need to be excluded from the output.
>
> > "CN=billgates,OU=Users,Disabled Accounts,DC=microsoft,DC=com"
> > "CN=melinda,OU=Users,OU=Disabled Accounts,DC=microsoft,DC=com"
> > "CN=billskid,OU=Users,OU=Development,DC=microsoft,DC=com"
>
> > I tried separating the disabled accounts out first (actual disabled
> > accounts, don't confuse with the OU=Disabled Accounts) with a:
>
> > compare-object $(dsquery user -limit 0) $(dsquery user -disabled
> > -limit 0) -passThru | where-object {$_.SideIndicator -eq "<="}
>
> > but that doesn't seem to work -- I've done this with a diff converted
> > from unix and that works properly, but where-object doesn't seem to
> > compare the lines as well. I end up with lots of disabled users in
> > there anyhow.
>
> > That's the first problem. Also, I need to exclude a few OUs from this
> > list. So, how can I take the above output and filter out lines that
> > include strings like "OU=Disabled" and "CN=Microsoft Exchange System
> > Objects"? This can't be done in the object model, right? Doesn't it
> > have to be done with strings? I can't figure out how to do that in a
> > PSH way (I could do it with grep, sed, etc.).
>
> > If I should be querying AD differently, great, but my understanding is
> > that wasn't included in PSH yet.
>
> > Thank You
>
> > bh- Hide quoted text -- Show quoted text -

@(statements) will execute the statementsand put the results in an array.
Using @() is important in the second example is important because we want
the results to be placed in an array regardless if its one item, zero or
many. If you use () and the result is one item then it won't be placed in
an array in which case -notmatch will return True or False rather than all
the elements that result in true.

PS>('foo') -notmatch 'bar'
True
PS>@('foo') -notmatch 'bar'
foo


"Brian Hoort" <brian.hoort@gmail.com> wrote in message
news:1168874478.218396.261050@51g2000cwl.googlegroups.com...
> Both of these solutions are very educational and helpful, Thank You
> gentlemen.
>
> In the second solution, the @ doesn't seem necessary. For the benefit
> of everyone here, is there a reason to do it? What benefits are there
> to using it?
>
> bh
>
> On Jan 12, 11:58 pm, "Marcel J. Ortiz [MSFT]"
> <mos...@online.microsoft.com> wrote:
>> If each entry is in a separate line something like this should work...
>>
>> dsquery user -limit 0 | where { $_ -notmatch 'Disabled Accounts' }
>>
>> or:
>>
>> @(dsquery user -limit 0) -notmatch 'Disabled Accounts' -notmatch
>> 'CN=Microsoft Exchange System Objects'
>>
>> "Brian Hoort" <brian.ho...@gmail.com> wrote in
>> messagenews:1168536313.635590.217720@i56g2000hsf.googlegroups.com...
>>
>>
>>
>> > I'm trying to get a list of all users in AD except ones in OUs "foo"
>> > and "fum", while also excluding disabled accounts. I'm having two
>> > problems with this. I'll try and explain:
>>
>> > I'm getting the full list of users with:
>>
>> > dsquery user -limit 0
>>
>> > This produces output like the following but includes disabled accounts
>> > and some oddball OUs and CNs that shouldn't really be included for
>> > processing which need to be excluded from the output.
>>
>> > "CN=billgates,OU=Users,Disabled Accounts,DC=microsoft,DC=com"
>> > "CN=melinda,OU=Users,OU=Disabled Accounts,DC=microsoft,DC=com"
>> > "CN=billskid,OU=Users,OU=Development,DC=microsoft,DC=com"
>>
>> > I tried separating the disabled accounts out first (actual disabled
>> > accounts, don't confuse with the OU=Disabled Accounts) with a:
>>
>> > compare-object $(dsquery user -limit 0) $(dsquery user -disabled
>> > -limit 0) -passThru | where-object {$_.SideIndicator -eq "<="}
>>
>> > but that doesn't seem to work -- I've done this with a diff converted
>> > from unix and that works properly, but where-object doesn't seem to
>> > compare the lines as well. I end up with lots of disabled users in
>> > there anyhow.
>>
>> > That's the first problem. Also, I need to exclude a few OUs from this
>> > list. So, how can I take the above output and filter out lines that
>> > include strings like "OU=Disabled" and "CN=Microsoft Exchange System
>> > Objects"? This can't be done in the object model, right? Doesn't it
>> > have to be done with strings? I can't figure out how to do that in a
>> > PSH way (I could do it with grep, sed, etc.).
>>
>> > If I should be querying AD differently, great, but my understanding is
>> > that wasn't included in PSH yet.
>>
>> > Thank You
>>
>> > bh- Hide quoted text -- Show quoted text -
>