0

I am trying to search Active Directory for deleted users with PowerShell, but am unable to return any results even though I have used the -IncludeDeletedObjects parameter. Here is the command that I used:

get-adobject -filter{Name -like "$user"} -includedeletedobjects -properties *
codewario
  • 19,553
  • 20
  • 90
  • 159
Pragnesh Panchal
  • 15
  • 1
  • 2
  • 7
  • This is going to be pretty tough for us to troubleshoot from outside your environment. I don't see anything glaringly wrong with that command. Are you using a user name that does exist? What does $user hold? – EBGreen Jul 10 '18 at 18:02
  • Is the activedirectory recycle bin enabled? If you just use `-Filter *` do you get any objects back? – Matt Jul 10 '18 at 18:04
  • Thanks guys for the response everything is working ok now – Pragnesh Panchal Jul 14 '18 at 18:00

3 Answers3

0

If you don't have the AD Recycle Bin enabled, you won't be able to find deleted objects.

If $user is expected to an exact match, you should also be using the -eq operator, not -like. If you want a fuzzy match, -like is correct but you should surround $user with * like so: *${user}*.

If $user is supposed to be the logon name, and not the friendly name of the user, then Name isn't the correct property to filter on, you will want to check against SamAccountName, not Name:

Get-ADObject -Filter "SamAccountName -eq '$user'"

If you are only interested in user objects, and not other AD object types, consider using
Get-ADUser in lieu of Get-ADObject. The syntax for what you specified above is the same, but will guarantee you only get ADUser objects, not ADComputer, ADGroup, etc.

Also, you should avoid using -Properties * and -Filter { ScriptBlock } arguments when using the AD cmdlets. Only use the Properties you need to process later, and use a string based filter like so:

Get-ADObject -Filter "Name -like '*$user*'"

See my answer here for best practices when using the -Filter parameter with AD cmdlets (also explains why not to use -Properties *), and this answer here for more details on why you should not use ScriptBlock parameters for AD filters.

codewario
  • 19,553
  • 20
  • 90
  • 159
0

The answer that worked for me is the command below will list all the users that were deleted from the Active Directory if your AD recycle bin is enabled and if you have sufficient privileges on Active Directory

Get-AdObject -Filter 'ObjectClass -eq "user" -and IsDeleted -eq $True' -IncludeDeletedObjects -Properties * | Ft Name,IsDeleted,WhenCreated
Itchydon
  • 2,572
  • 6
  • 19
  • 33
Pragnesh Panchal
  • 15
  • 1
  • 2
  • 7
0

Elevate your script or powershell console. That resolved the issue for me.

Michael
  • 1