How can I use Set-AdUser to change the state of this radio button without adding or removing computer accounts from the list? Another way to ask the same question is, how can I detect the state of this radio button using PowerShell, even if the list of computers is empty, but the button is set to "The following computers"?
The radio button reflects the state of the userWorkstatons attribute, if the value is not set, then the All computers radio button is set, the userWorkstaitons contains any value then the The following computers radio button is selected. ADUC does sometimes contradicting the previous statement. If you click on The following computers but don't enter anything and close the dialog, if you then click on Logon To against without closing the properties dialog, it will show the The following computers radio button still selected, However, if you close the user properties and open it again. Then the dialog will display the current state of the userWorkstation attribute and display All computers selected.
How to find all users that have the userWorkstations defined or The Following computers selected, you can use the following LDAP filter (&(objectclass=user)(userworkstations=*)) This is the powershell command
Get-ADUser -ldapfilter '(userWorkstations=*)'
To find the users that don't have the userWorkstations set or All Computers selected use the following command:
Get-ADUser -ldapfilter '(!userWorkstations=*)'
To set the userworkstations attribute use the following powershell command:
Set-ADUser -Identity $username -LogonWorkstations $comp
And to clear the userworkstations attribute user
Set-ADUser -Identity $username -LogonWorkstations $null
Gary.
I'll try that out, thanks for the information. The attributes are not well documented, there is mention that they are linked in some way, but exactly how was not clear. From your answer, it appears that userWorkstations should be read to get the current state and logonWorkstations can be used to set the state.
I see what you are saying now, if the list is empty, it is not possible for the radio button to really be set, it only looks like that because it has not refreshed.
I don't think that's contradictory behavior. Until you apply the changes or dismiss the user's property page (not cancel it), what you see in the UI is the state of the object in memory. When the UI applies the changes it finds the empty array of computers and just discards it. When you examine the user's property at a later time the user object is retrieved from the AD, not from memory.
Hello BrianMcMahon,
I usually use the next script to load workstations to users:
Import-Module ActiveDirectory
$complist = Import-Csv -Path "c:\workstationList.csv" | ForEach-Object {$_.NetBIOSName}
foreach($comp in $complist){
$comparray += $comp
}
Set-ADUser -Identity username -LogonWorkstations $comparray
As always if you have any questions please don't hesitate to contact us.
23 people are following this question.
