Build an Active Directory account review
The IT team needs a list of disabled accounts in its department. The exercise is a review, not an instruction to enable or delete anybody. Query the right properties and make the scope visible in the report.
Editable pipeline · fictional data · Microsoft documentation
The task
Get-ADUser returns user objects. Enabled is in the default property set; Department must be requested with -Properties in a real query. Select-Object can choose a property that is already present, but cannot retrieve an attribute the directory never returned.
- Treat Enabled as a Boolean, not the string "False".
- Separate directory-side query scope from client-side shaping.
- Return account identifiers alongside department evidence.
Genie tip: Treat Enabled as a Boolean, not the string "False".
See the objects move
Inspect this authored example with fictional data in the bounded browser model. The numbered stages show how its objects change.
Get-ADUser -Filter * -Properties Department | Where-Object Enabled -eq $false | Where-Object Department -eq 'IT' | Sort-Object SamAccountName | Select-Object SamAccountName,Department- Stage 1Get-ADUser
-Filter -Properties - Stage 2Where-Object
-eq - Stage 3Where-Object
-eq - Stage 4Sort-Object
Positional values or no named parameters - Stage 5Select-Object
Positional values or no named parameters
Build the reasoning
Request the report inputs
This lab supplies five fictional users. In a real domain, add the intended SearchBase and server rather than starting with a domain-wide report.
Filter the account state
Three accounts are disabled. Their departments differ; disabled does not mean they all belong in the IT review.
Make the evidence readable
Account names give the reviewer stable identifiers. Keeping Department makes an incorrect scope easier to spot.
Try it: predict, run and explain
| Name | SamAccountName | Enabled | Department |
|---|---|---|---|
| Asha Das | adas | $true | IT |
| Ravi Sen | rsen | $false | Finance |
| Nina Roy | nroy | $true | IT |
| Former Contractor | contract01 | $false | Operations |
| Meera Shah | mshah | $false | IT |
Select your predicted objects before revealing the output. Then edit one stage and inspect the change.
Ctrl / Command + Enter runs the editor. This bounded model uses the displayed fixture; it does not run PowerShell on a computer.
Predict first, then run the pipeline.
Find the mistake
Using a string as account state
Use $false. String conversion and PowerShell truthiness are easy to misread when a Boolean property is involved.
Replacing the review with a change
A report and an account change have different acceptance criteria. This exercise performs no writes and does not establish whether any account should be changed.
Department is empty for every result in a real query, but it is populated in the directory. What should you check first?
Prove it: write it alone
Return only disabled IT users, sorted by SamAccountName. Return exactly SamAccountName and Department. The command must still work when another disabled IT user appears.
The checker also runs your command against a fresh fixture. Matching today’s names alone is not enough.
Show a worked solution
Read the stages, close this explanation, then write and test your own attempt.
Take it to a real environment
For a real OU review, use a scoped Get-ADUser query and move suitable predicates into its -Filter parameter to reduce transferred data. Verify the filter syntax separately from Where-Object syntax. The browser models the displayed read-only subset; it does not test credentials, OU paths or domain permissions.
Real environment example · not executed here
Verify the details
Practise this
Read domain users
Import ActiveDirectory first. Return all fictional AD user records.
The sandbox is visible now. Sign in with Google only when you run or check a task; commands and temporary files are discarded when you leave.
Run a command to inspect its result.