Get-ADUser -Filter Example

Get-ADUser Filter

The PowerShell command Get-ADUser is part of the Active Directory PowerShell module. Go to this article if you want to know how to install it.

To search effectively for users in your Active Directory you should use the Filter switch. Don’t extract all users and then search the result set.

Use Get-ADUser -Filter to search directly for improved performance.

Understand the Get-ADUser Filter Parameter

With the many various filtering options available (LDAP filtering, oData v3.0 filtering, etc.) the filter switch often causes some confusion.

The filter switch used in the Get-ADUser and Get-ADGroup commands uses the PowerShell expression language in the query string.

This is different than e.g. when using the Get-AzureADUser command (which uses oData v3.0 filtering)!

The following operators should cover most of your needs:

OperatorMeaningSample expression
-eqEqual toDisplayName -eq ‘Jonas Watt Boolsen’
-neNot equal toCountry -ne ‘DK’
-gtGreater thanBadLogonCount -gt ‘0’
-geGreater than or equalModified -ge ’06-04-2021 12:00:00′
-ltLess thanLastLogonTimeStamp -lt ’01-01-2021′
-leLess than or equalCreated -le ’01-01-2020′
-likeWildcard searchMail -like ‘*@easy365manager.com’
-notlikeWildcard search with negationDepartment -notlike ‘*’
-andAndCountry -eq ‘DK’ -and Department -eq ‘Sales’
-orOrCountry -eq ‘DK’ -or -Country -eq ‘DE’

Please notice the following in the above examples:

  • Enclose the compared value(s) in apostrophes
  • Use -like ‘*’ and -notlike ‘*’ to find empty or non-empty values 
  • Filter “cryptic” date/time formats directly with a simple DateTime string representation (like e.g. the LastLogonTimeStamp attribute which uses the FileTime format)

Below you have some code snippets that should point you in the right direction on how to structure your filters for your Get-ADUser search queries:

Get-ADUser -Filter "DisplayName -eq 'Jonas Watt Boolsen'"
Get-ADUser -Filter "Country -ne 'DK'"
Get-ADUser -Filter "BadLogonCount -gt '0'"
Get-ADUser -Filter "Modified -ge '06-04-2021 12:00:00'"
Get-ADUser -Filter "LastLogonTimeStamp -lt '01-01-2021'"
Get-ADUser -Filter "Created -le '01-01-2020'"
Get-ADUser -Filter "Mail -like '*@easy365manager.com'"
Get-ADUser -Filter "Department -notlike '*'"
Get-ADUser -Filter "Country -eq 'DK' -and Department -eq 'Sales'"
Get-ADUser -Filter "Country -eq 'DK' -or -Country -eq 'DE'"

Summary

Hopefully you found this article helpful. Using the above snippets you should be able to compose almost any type of query you need.

Before you leave, please give this question a minute of your time (it may be well spent!):

Are you still using a confusing mix of Active Directory, Azure AD web console, Exchange Online Admin Center and PowerShell for your daily user and mailbox management?

Easy365Manager helps a lot of Office 365 admins all over the world to work more efficiently. Maybe you should try it out too?

Did you like this post? Maybe your friends will too!