Commands / Find-sqmADUser
Security

Find-sqmADUser

Searches Active Directory for user accounts matching a SamAccountName wildcard pattern, e.g. every service account with the so_* prefix. Prefers the ActiveDirectory RSAT module when available, and transparently falls back to a raw LDAP DirectorySearcher query when it isn't — no RSAT install required.

Module: sqmSQLTool
Requires: AD read access
ShouldProcess: No
Output: PSCustomObject[]

Execution Flow

START Resolve -Domain (else current user's domain) ActiveDirectory module available & loadable? foreach -Pattern (pipeline-capable) RSAT path active? RSAT PATH Get-ADUser -Filter SamAccountName -like $pat error → fall through LDAP FALLBACK DirectoryEntry + DirectorySearcher (sAMAccountName=<pattern>) '?' wildcard mapped to '*' (LDAP only supports '*') Add-to-results: SamAccountName, DisplayName, EmailAddress, Enabled, DistinguishedName, LastLogonDate, Domain, Source next pattern → Return PSCustomObject[] (all matches, all patterns) DONE
The module availability check runs once in begin, not per pattern — so a single RSAT failure doesn't repeatedly retry for every pipeline item. Wildcard syntax matches PowerShell's -like operator (* = any characters, ? = exactly one) in the RSAT path; the LDAP fallback only natively supports *, so ? is silently widened to * there — LDAP results can therefore be broader than RSAT results for the same pattern.

Parameters

ParameterTypeRequiredDescription
-PatternString[]RequiredWildcard pattern(s) for SamAccountName, e.g. 'so_*', 'svc-sql??', '*admin*'. Pipeline-capable (by value or by property name).
-DomainStringOptionalAD domain, e.g. "contoso.com". Default: the current user's domain.
-SearchBaseStringOptionalExplicit LDAP search path (DistinguishedName of an OU) to scope the search, e.g. 'OU=ServiceAccounts,DC=contoso,DC=com'.
-DomainControllerStringOptionalTarget domain controller. Only used on the RSAT (Get-ADUser) path.
-EnableExceptionSwitchOptionalThrow a terminating exception on error instead of Write-Error.

Return Value

Returns a PSCustomObject[] — one entry per matched account — with: SamAccountName, DisplayName, EmailAddress, Enabled, DistinguishedName, LastLogonDate, Domain, Source (RSAT or LDAP).

Examples

Example 1 — Find every service account by prefix

Find-sqmADUser -Pattern 'so_*'

Example 2 — Search a specific domain

Find-sqmADUser -Pattern 'svc-*' -Domain 'contoso.com'

Example 3 — Restrict to one OU

Find-sqmADUser -Pattern '*admin*' -SearchBase 'OU=Admins,DC=contoso,DC=com'

Example 4 — Multiple patterns via pipeline, filter disabled accounts

'so_*', 'svc-*' | Find-sqmADUser | Where-Object Enabled -eq $false