Why can't Get-ADObject against a GC use the SamAccountname for the -identity parameter, given that this attribute is in the GC? The help for that cmdlet lists only DN and GUID as acceptable for -identity, and indeed only those work. But its just more common to need to query the GC on a list of logon names (SamAccountnames) that could be in any domain in the forest, which is my case here.

Is this a limitation of LDAP, the GC, the partial attribute set, or the PS cmdlets?


You probably want to use Get-ADUser if you're trying to get a list of user logon names, or Get-ADComputer if you're looking for systems which log on as well.

Or if you for some other reason need to use Get-ADObject, you can use a filter on SAMAccountNames instead: Get-ADObject -f {SAMAccountName -like "*searchfilter*"}

I'm not familiar with the design decisions behind why only certain attributes are valid. But, I would imagine that you cannot query against all AD Objects by SAMAccountName because most AD objects don't have a SAMAccountName.


Use -property parameter to specify what you want to return

  • 1
    I'm sure the OP would appreciate an example. – womble Apr 26 '18 at 9:20
  • Seriously? It's a simple cmdlet, and the name of parameter was given... and a wrong answer was voted up ... I can't understand people – strongline Apr 27 '18 at 13:37
  • @strongline Specifying Get-ADObject -Property will give you an error as the switch you're looking for is "Properties." More than that, trying to run Get-ADObject -Properties SAMAccountName still requires you to enter a filter, or an identity, neither of which can use an object's SAMAccountName, if it exists for that object. The OP specifically asked why the Identity parameter for Get-ADObject cannot be an object's SAMAccountName. – RobbieCrash Apr 30 '18 at 20:07
  • the whole purpose of serverfault, or any other forum, is to give one a pointer. If one expects others to hold his hand to for step by step, he/she should not even be in IT. What's your point about the difference between "property" and "properties"? A typo, yes, but how hard it is to figure that out by anyone? To be frank, OP's question shouldn't even have been a question in the first place. The cmdlet is well documented, it's not hard to find the syntax - there is something called google. – strongline May 4 '18 at 13:15
  • @strongline the OP's question wasn't about how to syntactically use the cmdlet, it was about why a particular attribute wasn't a viable filter method,. They wanted to do get-adobject -identity <samaccountname> but can't because samaccountname isn't a valid identity filter. Telling them to do get-adobject -identity <samaccountname> -properties samaccountname isn't going to do what you're implying it will. – RobbieCrash May 4 '18 at 21:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.