Join Log in
Score:2
tangled_cables avatar Server

Get-ADComputer with ANY filter not working (module loaded)

cn flag
tangled_cables

I have spent many hours on this and engaged a number of people I know to be PowerShell experts without any luck. It should be simple but it is definitely not working out that way this time.

Objective:

  1. I want to get all computers in an OU (the computers in the OU will be changing - I am open to using a server list, but it will still need to run to get the computers in the OU daily and updating the txt file before continuing onto the second task - about to explain).
  2. I will then use the computers found in the OU to run gpupdate (not force, there is only one policy being linked at X time daily - this is being handled successfully by another set of PS scripts). I know this can be accomplished manually for OUs by that is not the way we want to go. We are using a third party tool to run the PS scripts on a schedule. Task scheduler is not used at this computer due to past issues with management, but regardless the 3rd party tool is fine. The issue is I cannot return the computers in the OU.

I CAN return all computers and their basic properties in my domain using:

Get-ADComputer -Filter *

However I have had 0 success running with "SearchBase" and any Filter:

Get-ADComputer -SearchBase "OU=WVDTestEnvironment,DC=contoso,DC=com" -Filter "*"

I have tried moving Filter to before SearchBase, removing the quotes around *, using single quotes, leaving out the filter and entering it when prompted as a *, changing case on nearly every word, verified OU name, domain etc, adding spaces between the OU and DCs, changing OU to CN, making sure the module is loaded (it is).

In the even I get this portion working, my snippet goes on to do the gpupdate after a pipe, but I have taken that off completely as I can't get past this basic part to collect the computer to update.

Additional note - this has been tried on Windows Server 2016 and Windows Server 2019, 16 gb 4 cpus, 32 gb 8 cpus, respectively, just to show the horsepower is there - the OSs may be significant as I haven't had issues in the past on 2012 servers and the page I found the bulk of the script was running it on 2012 R2 I believe.

I have tried running:

Get-ADComputer -Filter 'DistinguishedName -like "CN=contoso,CN=com"'

The above does not return an error, but it returns no results. Even though it should also return all computer accounts in domain.

The error I receive when trying to run my original snippet : Get-ADComputer -SearchBase "OU=WVDTestEnvironment,DC=contoso,DC=com" -Filter "*" is below: Powershell code and returned error

This OU is also a child/sub OU, so I did also attemptincluding the top level OU in my search base, but the error was the same (not pictured)

Get-ADComputer -SearchBase "OU=TopLevelOUName,OU=WVDTestEnvironment,DC=contoso,DC=com" -Filter "*"

Any help or pointers would be MUCH appreciated. I am confident I won't have any trouble with the GPUpdate command once I can get back either a text file of computers or computers held in memory and use the command after a pipe on the same powershell line. I can remove the pipe, add a new line, whatever is needed. I just need to get these computer accounts returned as this OU will fluctuate greatly as time goes on.

Originally found this PowerShell snippet at https://blog.thesysadmins.co.uk/group-policy-gpupdate-an-ou-of-computers.html (see method 2)

336
1 + 6
cn flag
Greg Askew
Distinguished name cannot be queried with a wildcard. https://social.technet.microsoft.com/wiki/contents/articles/5392.active-directory-ldap-syntax-filters.aspx . It would help if you confirmed the query works outside of PowerShell. You can run a custom query in AD Users and Computers advanced search.
0
Reply
Semicolon avatar
jo flag
Semicolon
Just a note, in the screenshot (and maybe elsewhere in your history, too), you typed one of the domain components as ...DC-<something>... instead of ...DC=<something>. typo; you've got a minus sign when it should be an equal sign. Don't know how much of that is to blame. But it surely is the cause for your screenshot error.
0
Reply
Semicolon avatar
jo flag
Semicolon
Here's some notes: Get-ADComputer -Filter * -SearchBase "OU=Blah,DC=blah,dc=domain,dc=com" Will 100% return any computer object in that path. If you're getting no results and no error, there's nothing in that path. If you're getting an error an no results - read the error, "Directory object not found" means you've got a bad OU in your search base -- likely meaning, you have entered the wrong DN for the OU you're looking for. OS-> doesn't matter / filter-searchbase order -> Doesn't matter / Capitalization -> DoesN't mAttEr / Invoke-GPUpdate -> really? Ick.
0
Reply
br flag
Lee_Dailey
[1] when you use `-Filter` ... you will ONLY get an error if there is a syntax error. if a filter returns nothing ... then that is a valid response and you will NOT see any error. ///// [2] the `-Filter *` stuff is nearly meaningless. don't do that - it adds complexity while doing absolutely no good.
0
Reply
tangled_cables avatar
cn flag
tangled_cables
@Semicolon Good catch, yes that was definitely a typo, but just one of many runs unfortunately. I believe I ran it just for this post in fact. The other runs I am confident as I was using a ps1 file with = signs did not have that issue. But awesome syntax catch. Also regarding my choice to use Invoke-GPUpdate was well... not my choice, new to company, they couldn't get it working, so here we are. Scheduled tasks are like banned here so that was a no. And this script is one of 3, it just applied the changes to a GPO to the OU computers, then when the GPO is unlinked later, it runs again.
0
Reply
tangled_cables avatar
cn flag
tangled_cables
@GregAskew I appreciate the feedback, I had no idea about distinguished name before. I will also definitely use the GUI to test next time I run into issues with scripts using the AD module.
0
Reply
Score:1
tangled_cables avatar Server
cn flag
tangled_cables

Oddly enough, this was resolved by adding a variable to hold computers and running in a for each loop: (additionally I had the OU order wrong, but that didn't explain the other tests I ran with top level OUs that failed.)

$computers = Get-ADComputer - Filter * - SearchBase "OU=WVDTestEnvironment,OU=TopLevelOU,DC=contoso,DC=com"

foreach ($computer in $computers) {

Invoke-GPUpdate -Computer $computer.Name -RandomDelayInMinutes 0

}

Thank you everyone for your help. Maybe this will help someone else in the future as well.

0 + 0
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.