Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Hey I've got this cmdlet here:

Get-ADUser -filter {(distinguishedName -notlike "Disabled Users") -and (enabled -eq $false)} -searchBase "ou=FirstOU,dc=domain,dc=com"

I've built it to find disabled users that are not in the "Disabled Users" OU. (an OU within an OU)

But for some reason it returns not only the disabled users that are not in "Disabled Users", but the disabled users that are in it as well.

Why doesn't (distinguishedName -notlike "Disabled Users") work?

To make my structure clear:

       Disabled Users OU
share|improve this question

Brackets and wildcards. Try

PS C:\Users\BigHomie> Get-ADUser -SearchBase "OU=Users,dc=eng,dc=mit,dc=edu" -SearchScope Subtree -Filter {distinguishedname -notlike "*Disabled*"}

Proper Syntax was found here

share|improve this answer
Thanks for correcting my oversight! – squillman Jun 4 '14 at 13:14
it's all good ;) – BigHomie Jun 4 '14 at 13:14
It does not output anything.. although I do have some users that should come out.. – NirPes Jun 4 '14 at 13:20
haha, perhaps your oneliner works as intended, and there are no disabled users outside the disabled OU? – BigHomie Jun 4 '14 at 13:22
@BigHomie nope. I have some disabled users that arent inside my Disabled Users OU. – NirPes Jun 4 '14 at 13:41

The filter acts on the type of object you are trying to retrieve, in this case a User object. Thus your query is returning any disabled users where the dn is not "Disabled Users". It is applying the filter to the User objects, not the OUs.

Yes, of course... The User dn will contain the string "Disabled Users" as BigHomie correctly pointed out. The real problem was the lack of wildcard characters, since the User dn will not be exactly "Disabled Users"

Try this instead:

Get-ADUser -Filter  {(Enabled -eq $false)} | ? { ($_.distinguishedname -notlike '*Disabled Users*') }
share|improve this answer
So how can I do it? – NirPes Jun 4 '14 at 13:03
But the dn of the user contains the parent OU – BigHomie Jun 4 '14 at 13:07
Dang it, beat me with the edit! :) Yeah, I'd grab all the users first, and then filter with Where-Object as well. – jscott Jun 4 '14 at 13:10

Your query doesn't work because DN attributes doesn't support wildcard matching in LDAP queries (and -like/-notlike is useless without wildcards).

You'll simply have to retrieve all disabled users and then filter the unwanted accounts out from the result:

$Disabled = Get-ADUser -Filter { useraccountcontrol -bor 2 } -SearchBase "ou=FirstOU,dc=domain,dc=com"
$Filtered = $AllDisabledUsers |Where-Object {$_.distinguishedName -notmatch "OU=Disabled Users"}

The { useraccountcontrol -bor 2 } is equivalent to a "pure" LDAP filter for disabled accounts:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.