I need to retrieve the values in the cfCardNumber attribute with PowerShell

Question

I need to retrieve the values in the cfCardNumber attribute with PowerShell

John Denney 0

I have users in a specific OU in Active Directory and need to retrieve the values in the cfCardNumber attribute which is in the Attribute Editor. I have tried for an individual;

Get-ADuser -Identity "joe.bloggs" -Properties * | Select-Object Name,cfCardnumber

cfCardNumber is blank

and

Get-ADUser -Identity "joe.bloggs" -Properties * | Format-List

cfCardNumber does not even appear

How do I get this value?

Thank you

Rich Matheisen 47,901 Reputation points

2025-06-05T20:02:28.7733333+00:00

Have you tried explicitly naming the property in the Get-ADUser cmdlets -Properties parameter?

Have you tried launching your script with "Run as administrator"?

Has the cfCardNumber property been added to your schema by 3rd-party software, or by your AD admin extending the AD schema?
John Denney 0 Reputation points

2025-06-20T04:28:31.2033333+00:00

I had to run as domain admin in order to retrieve the cfCardNumber values.

How do I check that this field is not set to "<not set>"?. I have tried,

$cfCardNumbger -eq $null

$cfCardNumbger -eq ""

$cfCardNumbger -eq "<not set>"

but they don't work
Rich Matheisen 47,901 Reputation points

2025-06-20T15:17:49.76+00:00

I don't think that attribute is present in the default active directory schema. Are you using a security software that uses "smart cards" to verify identity? If so, check with the software vendor for more information about the properties of the attribute.

You can also use ADSI Edit to find the attribute in the AD Schema. That should give you information about the property's attributes. For example, if the property is multi-valued you may get an empty array if the attribute isn't populated (perhaps the attribute allows the user to have multiple cards).

However, you've made a very common mistake (which sometimes has been described as a defect in PowerShell) when checking to see if a variable ($cfCardNumber, which in your example you seem to have repeatedly misspelled as $cfCardNumbger) contains a (possibly empty) array. As a general rule, you should always code such a check by placing the variable $null on the left side of the -eq operator, and the variable on the right side. This is because PowerShell will stream the contents of the array and compare each of the items it contains to $null. The behavior you want is to compare the variable itself to $null.

Try changing your comparison to $null -eq $cfCardNumber. Restricting access to the attribute probably makes sense if you don't want random processes to have the ability to read that attribute.