This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(179.20000000000002, 45%, 27%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EN%3C/text%3E%3C/svg%3E)
I want to read the "Enabled" field of user account information using Powershell Get-ADUser.
Here is the command that I used:
Get-ADUser -SearchBase "OU=Marketing,OU=Users,OU=Apple,DC=Orange,DC=Grape,DC=uk" -Filter * -Properties Enabled | select-object SAMAccountName, Enabled
And I got this kind of results:
SAMAccountName Enabled
--------------------- ---------
User1 True
User2 True
User3
User4 False
User5 True
User6
User7 False
Why some of the users returned "blank" for the "Enabled" field? I searched from the same OU. I got True and False results from some users though.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(256, 74%, 34%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERM%3C/text%3E%3C/svg%3E)
Run your script with elevated privileges. I.e., start Powershell with "Run as administrator".
As a regular user you may not have the necessary permission to access the state of those users.
Yup, that's what I did, Run as Administrator. So, that's not the root-cause.
What credentials are you using when you attempt to detect the status of the user object? Was it as a Domain Administrator?
Are the problematic users in any way privileged or protected users? (https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/protected-users-security-group)
In addition to being members of the "Protected Users" group, you should also check the "adminaccount" property (Get-ADUser -LDAPFilter "(admincount=1)" | Select Name,DistinguishedName) to check those users.