LogonWorkstions/UserWorkstation attribute is empty/null, but the radio button is set, how can I detect this situation?

Question

How can I use Set-AdUser to change the state of this radio button without adding or removing computer accounts from the list? Another way to ask the same question is, how can I detect the state of this radio button using PowerShell, even if the list of computers is empty, but the button is set to "The following computers"?

Answer 1

Hi @bmcmcm

The radio button reflects the state of the userWorkstatons attribute, if the value is not set, then the All computers radio button is set, the userWorkstaitons contains any value then the The following computers radio button is selected. ADUC does sometimes contradicting the previous statement. If you click on The following computers but don't enter anything and close the dialog, if you then click on Logon To against without closing the properties dialog, it will show the The following computers radio button still selected, However, if you close the user properties and open it again. Then the dialog will display the current state of the userWorkstation attribute and display All computers selected.

How to find all users that have the userWorkstations defined or The Following computers selected, you can use the following LDAP filter (&(objectclass=user)(userworkstations=*)) This is the powershell command

Get-ADUser -ldapfilter '(userWorkstations=*)'  

To find the users that don't have the userWorkstations set or All Computers selected use the following command:

Get-ADUser -ldapfilter '(!userWorkstations=*)'  

To set the userworkstations attribute use the following powershell command:

Set-ADUser -Identity $username -LogonWorkstations $comp  

And to clear the userworkstations attribute user

Set-ADUser -Identity $username -LogonWorkstations $null  

Gary.

Answer 2

Hello BrianMcMahon,

I usually use the next script to load workstations to users:

Import-Module ActiveDirectory
$complist = Import-Csv -Path "c:\workstationList.csv" | ForEach-Object {$_.NetBIOSName}
foreach($comp in $complist){
$comparray += $comp
}
Set-ADUser -Identity username -LogonWorkstations $comparray

---

As always if you have any questions please don't hesitate to contact us.