Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am using the Quest AD Cmdlets to pull information about computer accounts and bitlocker recovery information. I am currently using Get-QadComputer to pull the DN and then I am using Get-QADobject with the -searchRoot parameter to find all the child objects of that computer, which will give me the msFVE-RecoveryInformation child objects. What I am wondering is if I can use Get-QadComputer to do the entire query for me in one shot.

How can I use Get-QadComputer to return only computer objects that have msFVE-RecoveryInformation child objects? I was thinking of an LDAP filter, but I'm not sure how that would work for a child object.

share|improve this question
up vote 2 down vote accepted

I don't believe that this is possible with only one LDAP search, regardless of what type of child object you are looking for. In cases like this I usually try to find if there is an attribute in either the parent or the child that references the other so that I can use that to retrieve the data I want, but in this case there doesn't seem to be.

What might be a better approach than invoking an LDAP search for each computer is this: 1. Use Get-QADObject to enumerate the msFVE-RecoveryInformation objects in your environment, starting from as low of a search root as possible. 2. Build a list of DNs for the parent computer objects using the data retrieved from those objects and store those DNs in an array. 3. Either call Get-QADComputer and use Where-Object to filter out the computers without a DN matching those stored in your array or if there are not many computers that are bitlocker enabled, call Get-QADComputer for each DN in your array to get the computer objects.

FYI, I did a quick Google search for "BitLocker cmdlets" to see if there was an easier way and it returned a link to a "Future Resource" document for Windows Server 2008 R2, so maybe these are coming at some point. All that document says for now though is "The document you are attempting to access is not yet available."

share|improve this answer

I'm not familiar with that property but may be able to add "where $_.msFVE-RecoveryInformation" to the Get-QadComputer query statement

This tutorial (section titled "The Filtering Station") may help you.

share|improve this answer
msFVE-RecoveryInformation is not a property on the computer object. The computer object is actually the parent object and the mSFVE-RecoveryInformation is a completely separate child object. – Andy Schneider Sep 15 '10 at 17:43
Sorry about that. Let me look to see if there is a 'is parent' or 'has child' type of property... – gWaldo Sep 15 '10 at 18:30
Actually, the other guy's answer is better; I was going to say something along those lines, but he said it better. +1 to Poshoholic – gWaldo Sep 15 '10 at 18:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.