User attribute "Enabled" is blank for some disabled users in Active Directory

user_2885486 0
Viewed 4318

I was trying to list active and disabled users in AD using powershell commands. 

Get-ADUser -Filter {Enabled -eq $false} | FT samaccountname

But the list was incorrectly populated. Some of the disabled users were listed in active user list.

When I checked those users' attributes, I found that the "Enabled" attribute is blank for those users. It was neither true nor false.

Please advise on how to update their attributes.

powershell
3 Answers

I realize this is an old question, but answering it for others who search for it.

I ran into this same issue, running the command with a domain admin account, about half the accounts were coming back with both the userAccountControl and Enabled coming back as blank, but using ADUC, I could view the userAccountControl on the attributes tab.

I can't explain the reasoning, but running powershell as administrator resolved the issue.

user_146350350

Almost always with AD filters you want to enclose variables like $false or $true in quotes.

Try this, open powershell and runas administrator then use the following:

Get-ADUser -Filter 'Enabled -eq $false' | ft samaccountname,enabled

Your domain account may not have read permissions on userAccountControl.

user_103724780

Run the powershell console elevated (as Administrator).

user_8430000
Related