Get AD Computers not in Group A and output list that computer's Distinguished Name and Description

Question

question

YanJayden-2649 asked May 6, '22 NewbieJones-6218 commented May 12, '22

Get AD Computers not in Group A and output list that computer's Distinguished Name and Description

How to use Powershell scripts to get AD Computers not in Group A and output list that computer's Distinguished Name and Description?

windows-server-powershell windows-active-directory

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 1 · 2022-05-06T11:04:05.92Z

NewbieJones-6218 answered May 6, '22 NewbieJones-6218 edited May 6, '22

Quick and dirty.
This uses the memberOf attribute on the computer object and then filters client side (Where-Object) for those that aren't in the group.
I recommend setting the searchbase and using the distinguishedName for the group.

 Get-ADComputer -Filter * -SearchBase "OU=Computers,OU=xxx,DC=xxx,DC=yyy,DC=zzz" -Properties MemberOf, Description | 
     Where-Object {"CN=groupA,OU=Groups,OU=xxx,OU=xxx,DC=xxx,DC=yyy,DC=zzz" -NotIn $_.memberof} 
         | Select distinguishedName, Description

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 2 · 2022-05-12T07:28:38.323Z

LimitlessTechnology-2700 answered May 12, '22 NewbieJones-6218 commented May 12, '22

Hi YanJayden-2649,

Try this method:

Grab the computer names from the first security group

$group1 = Get-ADGroup -Identity 'Every Day WSUS 3am Install'
$group2 = Get-ADGroup -Identity 'Every Day WSUS 6am Install'

grab all computer obejects that are servers from AD and list the names not found in either security group

Get-ADComputer -LDAPFilter "(&(objectcategory=computer)(OperatingSystem=*server*))"
-Properties MemberOf |
Where-Object {
( $.MemberOf -notcontains $Group1.DistinguishedName ) -and
( $.MemberOf -notcontains $Group2.DistinguishedName )
} |
Select-Object -ExpandProperty Name

--If the reply is helpful, please Upvote and Accept as answer--

· 1

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

NewbieJones-6218 · May 12 at 12:35 PM

Not fully understanding this addition to an answered question.

Your ldapfilter is only going to return server operating systems. (I can't see this in the original posters requirements).

Your where-object is client side filtering on two groups, which I also can't see requested in the original requirements.

Your final select-object is only showing name, where the poster requested DisplayName and Description.

I'm wondering if this answer was meant for another thread.

0 ·

question