Powershell – How to use get-qadcomputer to return all computer objects that have msFVE-RecoveryInformation child objects

active-directorypowershell

I am using the Quest AD Cmdlets to pull information about computer accounts and bitlocker recovery information. I am currently using Get-QadComputer to pull the DN and then I am using Get-QADobject with the -searchRoot parameter to find all the child objects of that computer, which will give me the msFVE-RecoveryInformation child objects. What I am wondering is if I can use Get-QadComputer to do the entire query for me in one shot.

How can I use Get-QadComputer to return only computer objects that have msFVE-RecoveryInformation child objects? I was thinking of an LDAP filter, but I'm not sure how that would work for a child object.

Best Answer

I don't believe that this is possible with only one LDAP search, regardless of what type of child object you are looking for. In cases like this I usually try to find if there is an attribute in either the parent or the child that references the other so that I can use that to retrieve the data I want, but in this case there doesn't seem to be.

What might be a better approach than invoking an LDAP search for each computer is this: 1. Use Get-QADObject to enumerate the msFVE-RecoveryInformation objects in your environment, starting from as low of a search root as possible. 2. Build a list of DNs for the parent computer objects using the data retrieved from those objects and store those DNs in an array. 3. Either call Get-QADComputer and use Where-Object to filter out the computers without a DN matching those stored in your array or if there are not many computers that are bitlocker enabled, call Get-QADComputer for each DN in your array to get the computer objects.

FYI, I did a quick Google search for "BitLocker cmdlets" to see if there was an easier way and it returned a go.microsoft.com link to a "Future Resource" document for Windows Server 2008 R2, so maybe these are coming at some point. All that document says for now though is "The document you are attempting to access is not yet available."

Related Solutions

PowerShell Script to Loop Over All Users in a Group

You get this error because the LDAP path that you are sending to the loop is not right. You are pipeing $user.Member to the ForEach-Object, it sends all users and not one bye one.

So you are sending something like:

ldap://proddc6.prod.root/CN=User1,CN=Users,DC=prod,DC=root CN=User2,CN=Users,DC=prod,DC=root

I created this script based on yours, it do what you need: interate over the members of a group. Do what you want with the object $useradsi in the loop.

$ou="User Groups"
$userADName="RRAS VPN SSL"
$objADSI = [adsi]””
$domain = $objADSI.distinguishedname
$userADPath="LDAP://CN="+$userADName+",OU="+$ou+",$domain"
$user = [adsi] $userADPath

foreach($child in $user.member) {
$useradsi = [adsi] "LDAP://$child"
}

Windows PowerShell Select removing columns

You don't want to use Select-String. Powershell offers Where-Object cmdlet for this sort of filtering:

Get-WmiObject -List | Where-Object { $_.Name -eq "Win32_LogicalDisk" }

You may also use Select-Object to expand the property "Properties" on the object returned from Where-Object:

Get-WmiObject -List | Where-Object { $_.Name -eq "Win32_LogicalDisk" } | Select-Object -ExpandProperty Properties

If you want to explore WMI, there are many tools available. One Powershell version, WMI Explorer may be of particular interest to you.

Best Answer

Related Solutions

PowerShell Script to Loop Over All Users in a Group

Windows PowerShell Select removing columns

Related Topic