Get-ADUser Filter OU: Targeting Users in a Specific Organizational Unit

Get-ADUser Filter OU: Targeting Users in a Specific Organizational Unit

Using Get-ADUser with an LDAP filter and a defined SearchBase is the standard way to return only users inside a specific Organizational Unit in Active Directory. Without a filter, Get-ADUser can return every object in the domain, which is slow and noisy. Combining -SearchBase with -LDAPFilter narrows results to the OU you care about and lets you pull exactly the attributes you need.

Basic Syntax

The core pattern pairs -SearchBase (the OU's distinguished name) with -LDAPFilter (the LDAP query string). The cmdlet treats the filter as an LDAP query, not PowerShell syntax, so the query uses prefix notation like (attribute=value).

Get All Users in an OU

Get-ADUser -SearchBase 'OU=Sales,DC=contoso,DC=com' -LDAPFilter '(objectClass=user)'

This returns every user object in the Sales OU. It does not return groups, computers, or containers. The (objectClass=user) filter is inclusive of both user and inetOrgPerson objects, which is usually what you want.

Common Filter Patterns

LDAP filters use prefix notation: the operator comes first, then the attributes. You can combine conditions with the & (and) and | (or) operators. Parentheses group expressions.

Filter by a Single Attribute

Get-ADUser -SearchBase 'OU=Employees,DC=contoso,DC=com' -LDAPFilter '(department=Sales)'

This returns users whose department attribute equals Sales exactly. The match is case-insensitive but whitespace-sensitive, so trailing spaces in the attribute value will prevent a match.

Filter by Enabled Status

Get-ADUser -SearchBase 'OU=Finance,DC=contoso,DC=com' -LDAPFilter '(&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=512))'

The bitwise filter on userAccountControl returns only enabled accounts. To get disabled accounts, change the value to 514.

Combine Multiple Conditions

Get-ADUser -SearchBase 'OU=IT,DC=contoso,DC=com' -LDAPFilter '(&(objectClass=user)(title=Administrator)(department=IT))'

The & operator joins the three clauses, so the result is only users who match all conditions.

Why -SearchBase Matters

-SearchBase scopes the query to a single OU and its sub-OUs by default. Without it, Get-ADUser searches the entire domain, which is unnecessary when you only need one OU and can also pull in objects you do not want.

Using -Filter Instead of -LDAPFilter

The -Filter parameter uses PowerShell expression syntax rather than LDAP syntax, which reads more naturally for simple queries. However, -Filter cannot express bitwise operations on userAccountControl, so for enabled/disabled checks you must use -LDAPFilter.

Get-ADUser -SearchBase 'OU=HR,DC=contoso,DC=com' -Filter 'Title -eq "Manager" -and Department -eq "HR"'

This returns users whose Title is Manager and Department is HR. Quoted string values in -Filter must use escaped quotes if the string itself contains quotes.

Pulling Specific Attributes

By default, Get-ADUser returns Name, SamAccountName, and DistinguishedName. Use -Properties to retrieve additional attributes like Title, Department, EmailAddress, or LastLogonDate, then select or format them.

Get-ADUser -SearchBase 'OU=Operations,DC=contoso,DC=com' -LDAPFilter '(objectClass=user)' -Properties Title, Department, EmailAddress | Select-Object Name, SamAccountName, Title, Department, EmailAddress

Common Mistakes

• Omitting -SearchBase and querying the entire domain when you only need one OU.
• Using LDAP filter syntax in -Filter or PowerShell syntax in -LDAPFilter, which produces no results or errors.
• Forgetting to specify -Properties for attributes beyond the default set.
• Using a distinguished name that points to a container or domain rather than the target OU.

When to Use This Pattern

This pattern is ideal for ad hoc reporting, migration validation, permission audits, and cleanup scripts where you need a predictable set of users from a known OU. For cross-OU queries, remove -SearchBase or specify a higher-level container DN. For domain-wide queries, omit -SearchBase entirely and rely on the filter to narrow results.