Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Ive got this cmdlet and I'd like to limit the results to only one OU:

Get-ADUser -Filter  {(Enabled -eq $false)} | ? { ($_.distinguishedname -notlike '*Disabled Users*') } 

Now Ive tried to use

-searchbase "ou=FirstOU,dc=domain,dc=com"

But if I use -SearchBase I get this error:

Where-Object : A parameter cannot be found that matches parameter name 'searchb
At line:1 char:114
+ Get-ADUser -Filter  {(Enabled -eq $false)} | ? { ($_.distinguishedname -notli
ke '*Disabled Users*') } -searchbase <<<<  "ou=FirstOU,dc=domain,dc=com"
    + CategoryInfo          : InvalidArgument: (:) [Where-Object], ParameterBi
    + FullyQualifiedErrorId : NamedParameterNotFound,Microsoft.PowerShell.Comm

What Im trying to do is to get all the disabled users from a specific OU, BUT, there is an OU INSIDE that FirstOU that I want to exclude: the "Disabled Users" OU.

as you might have guessed I want to find disabled users in a specific OU that are not in the "Disabled Users" OU inside that OU.

my structure:

      Disabled Users OU
share|improve this question
up vote 7 down vote accepted

The -SearchBase parameter has to be used with Get-ADUser, not Where-Object (aliased by ?). This should work:

Get-ADUser -Filter {(Enabled -eq $false)} -SearchBase "ou=FirstOU,dc=domain,dc=com" | ? { ($_.distinguishedname -notlike '*Disabled Users*') }
share|improve this answer
-1 Most efficient method of searching only a single OU is using -SearchScope as in Thorfinn Thomassen's answer in this question. Using Where-Object makes the Get-AdUser return the nested OU as well whose contents should end up being all eliminated by end of processing. – user66001 Mar 9 at 20:21
Also, your answer contains a subset of the same information as Hopelessn00b's answer. Suggest your answer be removed to avoid duplication. – user66001 Mar 9 at 20:24

The easiest way to limit the search to one OU is using SearchScope:

Get-ADUser -Filter  {(Enabled -eq $false)} -SearchScope OneLevel -SearchBase "ou=FirstOU,dc=domain,dc=com"
share|improve this answer
+1 For use of SearchScope to limit search to that first OU, and not spend time parsing the nested one. – user66001 Mar 9 at 20:25

Easiest way would be to put the -SearchBase before the -Filter.

Get-ADUser -searchbase "ou=FirstOU,dc=domain,dc=com" -Filter {(Enabled -eq $false)} | ? { ($_.distinguishedname -notlike '*Disabled Users*') }

Gets around the problem of having to use -SearchBase with Get-ADUser, and not Where-Object (? is aliased to Where-Object in PowerShell) by running the Where-Object after you've already passed your -SearchBase to Get-ADUser.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.