I got a PowerShell command that gives me a list of users and the groups those users are members of. The only problem is that is gives me every user including those that are disabled. I need to be able to list just the active users and their respective groups. Any help would be appreciated.

$adsi = [ADSI]"WinNT://$env:COMPUTERNAME"
$adsi.Children | where {$_.SchemaClassName -eq 'user'} | Foreach-Object {    $groups = $_.Groups() | Foreach-Object {$_.GetType().InvokeMember('Name', 'GetProperty', $null, $_, $null)} ; $_ | Select-Object @{n='UserName';e={$_.Name}},@{n='Groups';e={$groups -join ';'}} } | Format-Table -autosize -wrap

You might use a WMI query to get AccountType (512 = Enabled, 514 = Disabled):

Edit: there are other flags which indicate enabled accounts, but the basic enabled/disabled is 512/514. Refer to this list.

Third try:

Function Check-Enabled ($Username) {
   -not (Get-WmiObject Win32_UserAccount -filter "LocalAccount=True AND Name='$Username'").disabled

Then add the property to your Select-Object. I also formatted it for my own readability, but still the same code:

$adsi = [ADSI]"WinNT://$env:COMPUTERNAME"
$adsi.Children | where { $_.SchemaClassName -eq 'user' } | Foreach-Object {
   $groups = $_.Groups() | Foreach-Object {
      $_.GetType().InvokeMember('Name', 'GetProperty', $null, $_, $null)
   $_ | Select-Object @{n='UserName';e={$_.Name}},
                      @{n='Groups';e={$groups -join ';'}},
                      @{n='Enabled';e={Check-Enabled $_.Name}}
} | Format-Table -autosize -wrap
| improve this answer | |
  • 1
    +1 For just making the effort to untangle the original copy/paste horror show. – jscott Feb 3 '16 at 0:33
  • For whatever reason, the local Administrator and Guest were both returning 512. I've tried this on two computers (Win 7 and Win8.1) and verified both had the Guest account disabled, but they returned 512 on both. – raetrace Feb 3 '16 at 0:51
  • In the function Check-Enabled you provided, if I replace Select -ExpandProperty AccountStatus with Select -ExpandProperty Status and replace the -eq 512 with -ne 'Degraded' then I get exactly what I'm looking for. Now I just need to filter out the Enabled fields that have False. Thank you for pointing me in the right direction. – raetrace Feb 3 '16 at 1:02
  • The updated Check-Enabled function you provided has the same problem. It's returning the Guest account as Enabled=True, when in fact it is not. The newer one you posted is much faster though, so if we can get the new Function to either exclude disabled accounts or correctly mark them False then that would be perfect. – raetrace Feb 3 '16 at 1:17
  • I updated the function – xXhRQ8sD2L7Z Feb 3 '16 at 1:31

Much more easier way with WMI

Get-WmiObject -Class win32_useraccount -filter "localaccount=true" | where {$_.disabled -eq $False}
| improve this answer | |

Starting with Version 5.1 PowerShell also comes with an builtin cmdlet called Get-LocalUser Powershell Local Accounts

Get-LocalUser | Where-Object -Property Enabled -eq True
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.