Get-ADUser -Identity doesn't support UPN or forest functionality?

Question

I was very surprised to discover that the -Identity switch for "Get-ADUser" doesn't support UPN. It already supports GUID and SID in addition to DistinguishedName and sAMAccountName. Is there a plan to add support for UPN?

Also, is there really no way to do a forest search with Get-ADUser? Couldn't you add a -Forest flag or detect the correct domain in the forest based on the "DC=" elements of DN or the user SID sans RID (or the search base if specified)?

Something like this works -- but seems crazy. Am I missing something?
get-adforest | select -ExpandProperty Domains | % { Try { get-aduser -server $_ -identity "someuser" } catch {} }

Answer 1

You can use a Global Catalog server to search the entire forest. Use the -Server parameter and add ":3268" (the GC port number) at the end of the server name.

For example:

Get-ADUser -Identity "someuser" -Server GCServerName:3268

To use the UPN instead of using the -Identity parameter and being restricted to using a DN, GUID, SID, or sAMAccountName, use -Filter instead. The drawback to using -Filter is that if it fails to find a match it won't throw an exception so you have to check to see if there was anything returned instead of relying on "-ErrorAction Stop" and Try/Catch.

Answer 2

Hi @Greg Corey ,

You can submit your feedback over here
https://windowsserver.uservoice.com/forums/301869-powershell

Best Regards，
Ian

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.