Get-ADUser -Filter syntax: examples with -like, variables, dates and -Properties

Get-ADUser -Filter takes a query string in the Active Directory module's filter language, which looks like PowerShell: attribute -operator value, combined with -and, -or and -not. Put the whole filter in quotes and the value in inner quotes: Get-ADUser -Filter "Surname -like 'Smi*'". -Filter * returns every user. By default only a small set of properties is returned; add -Properties for anything else.

Import-Module ActiveDirectory
Get-ADUser -Filter "Surname -like 'Smi*'"
Get-ADUser -Filter 'Enabled -eq $false' | Select-Object Name, SamAccountName
Get-ADUser -Filter * -SearchBase 'OU=Sales,DC=contoso,DC=com' -Properties Department, Title

The module comes with RSAT (see install RSAT on Windows 11) and needs a domain controller with Active Directory Web Services.

Common filters

Supported operators are -eq, -ne, -like, -notlike, -lt, -le, -gt, -ge, -approx, -bor, -band, -recursivematch, -and, -or and -not. PowerShell operators such as -match, -contains and -in are not part of the filter language; filter on the server with -like, then refine with Where-Object if needed.

Variables in a filter

The filter is a string that the module parses, so variables must end up as plain values:

$sam = 'jdoe'
Get-ADUser -Filter "SamAccountName -eq '$sam'"          # string: PowerShell expands $sam first

$user = Get-ADUser jdoe -Properties Department
$dept = $user.Department                                 # copy properties to a simple variable first
Get-ADUser -Filter 'Department -eq $dept' -Properties Department

Expressions such as $user.Department inside the filter are not evaluated by the module; assign them to a simple variable first.

Dates

$cutoff = (Get-Date).AddDays(-90)
Get-ADUser -Filter 'LastLogonDate -lt $cutoff -and Enabled -eq $true' -Properties LastLogonDate |
  Select-Object Name, LastLogonDate

LastLogonDate is a converted view of lastLogonTimestamp, which replicates with a delay of up to about two weeks; Search-ADAccount -AccountInactive wraps this query.

Narrow the search