Return
-
Title
When using the Get-QADUser cmdlet, the "-SearchRoot" parameter is being ignored -
Description
When using both the -SearchRoot and -Identity parameters on the Get-QADUser cmdlet in a PowerShell script, the specified SearchRoot is ignored and all results are returned. -
Cause
This is expected functionality.
The PowerShell Help documentation included with the Active Roles Management Shell states the following regarding the SearchRoot parameter:
-SearchRoot <IdentityParameter[]>Specify the DN, GUID or canonical name of the domain or container to search. By default, the cmdlet searches the entire sub-tree of which SearchRoot is the topmost object (sub-tree search). This default behavior can be altered by using the SearchScope parameter.The search criteria are defined by the LdapFilter parameter value and the values of attribute-specific parameters.The cmdlet disregards this parameter if an Identity value is supplied. If you want this parameter to have effect, do not supply any Identity value on the command line.Required? falsePosition? namedDefault valueAccept pipeline input? falseAccept wildcard characters? false -
Resolution
WORKAROUND
Do not use the -Identity parameter if it is necessary to specify a SearchRoot as well. Instead, use one of the other identifying parameters, such as -SamAccountName