0

I have recently deployed LAPS (Local admin password service) on our domain, and would now like to create a script I can run to find machines that have not yet communicated with AD to install the group policy extension and update their local admin password.

I can see that if I run:

Get-AdComputer -Identity Computer_Name -Properties *

I am presented with a computer that has updated its password, and shows the two properties:

ms-Mcs-AdmPwd
ms-Mcs-AdmPwdExpirationTime

My powershell is not great, so I may have the syntax wrong, but when trying to run:

Get-AdComputer -Filter {ms-Mcs-AdmPwd -ne ''}

I get an error that says:

The search filter cannot be recognised

Can anyone advise how I can filter on these two properties? Do I have to pipe into a Where-Object or perhaps even use LDAP filters?

3 Answers 3

1

The most appropriate way to do this is with an LDAP filter rather than a PowerShell filter. LDAP filters can test for existence, rather than comparing to a value that could be there (even if it's only remotely possible).

To get a list of computers WITH a password:

Get-ADComputer -LDAPFilter "(ms-mcs-AdmPwd=*)"

And to find computers without one:

Get-ADComputer -LDAPFilter "(!(ms-mcs-AdmPwd=*))"

You can combine that with other parameters to Get-ADComputer if you want to search a specific OU etc.

0

Ok so I think my issue was to do with me looking for attributes that had not yet been set.

I suspect there may be an ever so slightly more elegant way to filter, but the below works just fine for me:

 Get-ADComputer -Filter {ms-Mcs-AdmPwd -notlike "*"}
0

If I run the command

Get-ADComputer -Filter {ms-Mcs-AdmPwd -notlike '<not set>'}

on my 2016 DC I get a list with all the computers with a password set.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.