question

BrianMcMahon-2316 avatar image
0 Votes"
BrianMcMahon-2316 asked LimitlessTechnology-2700 answered

LogonWorkstions/UserWorkstation attribute is empty/null, but the radio button is set, how can I detect this situation?

How can I use Set-AdUser to change the state of this radio button without adding or removing computer accounts from the list? Another way to ask the same question is, how can I detect the state of this radio button using PowerShell, even if the list of computers is empty, but the button is set to "The following computers"?

142135-2021-10-20-9-20-54.jpg


windows-server-powershellwindows-active-directory
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

GaryReynolds avatar image
1 Vote"
GaryReynolds answered GaryReynolds commented

Hi @BrianMcMahon-2316

The radio button reflects the state of the userWorkstatons attribute, if the value is not set, then the All computers radio button is set, the userWorkstaitons contains any value then the The following computers radio button is selected. ADUC does sometimes contradicting the previous statement. If you click on The following computers but don't enter anything and close the dialog, if you then click on Logon To against without closing the properties dialog, it will show the The following computers radio button still selected, However, if you close the user properties and open it again. Then the dialog will display the current state of the userWorkstation attribute and display All computers selected.

How to find all users that have the userWorkstations defined or The Following computers selected, you can use the following LDAP filter (&(objectclass=user)(userworkstations=*)) This is the powershell command

 Get-ADUser -ldapfilter '(userWorkstations=*)'

To find the users that don't have the userWorkstations set or All Computers selected use the following command:

 Get-ADUser -ldapfilter '(!userWorkstations=*)'

To set the userworkstations attribute use the following powershell command:

 Set-ADUser -Identity $username -LogonWorkstations $comp

And to clear the userworkstations attribute user

 Set-ADUser -Identity $username -LogonWorkstations $null


Gary.






· 3
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

I'll try that out, thanks for the information. The attributes are not well documented, there is mention that they are linked in some way, but exactly how was not clear. From your answer, it appears that userWorkstations should be read to get the current state and logonWorkstations can be used to set the state.

I see what you are saying now, if the list is empty, it is not possible for the radio button to really be set, it only looks like that because it has not refreshed.

0 Votes 0 ·

I don't think that's contradictory behavior. Until you apply the changes or dismiss the user's property page (not cancel it), what you see in the UI is the state of the object in memory. When the UI applies the changes it finds the empty array of computers and just discards it. When you examine the user's property at a later time the user object is retrieved from the AD, not from memory.

0 Votes 0 ·

Agree, poor wording on my part, contradicting = causes confusion

0 Votes 0 ·
LimitlessTechnology-2700 avatar image
0 Votes"
LimitlessTechnology-2700 answered

Hello BrianMcMahon,

I usually use the next script to load workstations to users:

Import-Module ActiveDirectory
$complist = Import-Csv -Path "c:\workstationList.csv" | ForEach-Object {$_.NetBIOSName}
foreach($comp in $complist){
$comparray += $comp
}
Set-ADUser -Identity username -LogonWorkstations $comparray



As always if you have any questions please don't hesitate to contact us.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.