I got a PowerShell command that gives me a list of users and the groups those users are members of. The only problem is that is gives me every user including those that are disabled. I need to be able to list just the active users and their respective groups. Any help would be appreciated.

$adsi = [ADSI]"WinNT://$env:COMPUTERNAME"
$adsi.Children | where {$_.SchemaClassName -eq 'user'} | Foreach-Object {    $groups = $_.Groups() | Foreach-Object {$_.GetType().InvokeMember('Name', 'GetProperty', $null, $_, $null)} ; $_ | Select-Object @{n='UserName';e={$_.Name}},@{n='Groups';e={$groups -join ';'}} } | Format-Table -autosize -wrap

4 Answers 4


You might use a WMI query to get AccountType (512 = Enabled, 514 = Disabled):

Edit: there are other flags which indicate enabled accounts, but the basic enabled/disabled is 512/514. Refer to this list.

Third try:

Function Check-Enabled ($Username) {
   -not (Get-WmiObject Win32_UserAccount -filter "LocalAccount=True AND Name='$Username'").disabled

Then add the property to your Select-Object. I also formatted it for my own readability, but still the same code:

$adsi = [ADSI]"WinNT://$env:COMPUTERNAME"
$adsi.Children | where { $_.SchemaClassName -eq 'user' } | Foreach-Object {
   $groups = $_.Groups() | Foreach-Object {
      $_.GetType().InvokeMember('Name', 'GetProperty', $null, $_, $null)
   $_ | Select-Object @{n='UserName';e={$_.Name}},
                      @{n='Groups';e={$groups -join ';'}},
                      @{n='Enabled';e={Check-Enabled $_.Name}}
} | Format-Table -autosize -wrap
  • 1
    +1 For just making the effort to untangle the original copy/paste horror show.
    – jscott
    Feb 3, 2016 at 0:33
  • For whatever reason, the local Administrator and Guest were both returning 512. I've tried this on two computers (Win 7 and Win8.1) and verified both had the Guest account disabled, but they returned 512 on both.
    – raetrace
    Feb 3, 2016 at 0:51
  • In the function Check-Enabled you provided, if I replace Select -ExpandProperty AccountStatus with Select -ExpandProperty Status and replace the -eq 512 with -ne 'Degraded' then I get exactly what I'm looking for. Now I just need to filter out the Enabled fields that have False. Thank you for pointing me in the right direction.
    – raetrace
    Feb 3, 2016 at 1:02
  • The updated Check-Enabled function you provided has the same problem. It's returning the Guest account as Enabled=True, when in fact it is not. The newer one you posted is much faster though, so if we can get the new Function to either exclude disabled accounts or correctly mark them False then that would be perfect.
    – raetrace
    Feb 3, 2016 at 1:17
  • I updated the function Feb 3, 2016 at 1:31

Much more easier way with WMI

Get-WmiObject -Class win32_useraccount -filter "localaccount=true" | where {$_.disabled -eq $False}

Starting with Version 5.1 PowerShell also comes with an builtin cmdlet called Get-LocalUser Powershell Local Accounts

Get-LocalUser | Where-Object -Property Enabled -eq True

The syntax is:

Get-LocalUser | Where-Object -Property Enabled -like true

Get-LocalUser | Where-Object -Property Enabled -like false

-eq operator does not output disabled accounts

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.