Member Avatar for Radio2006

Hello all,

The issue I am having involves a user that uses a CAC to log in to a network. When the account is created, a 10-digit number printed on the CAC is associated with the users account and replaces their User Logon Name in ADUC.

This users number was incorrectly applied to another account, but with thousands of users its practically impossible to search everh one of them one by one.

I am attempting to use Powershell to search by UPN to identify the account that has the number associated incorrectly, but I am only finding syntax that set UPN or search by ADUser. Can anyone offer any assistance? Thanks in advance.

  • 2 Contributors
  • 2 Replies
  • 2K Views
  • 1 Year Discussion Span
  • Latest Post Latest Post by Radio2006

Dani AI

Generated

Nice catch, . Since you solved it with the function shared, here is a built-in ActiveDirectory-module approach you can keep on hand. It searches every domain in the forest, handles unknown UPN suffixes, and helps spot duplicates tied to the same CAC number.

Import-Module ActiveDirectory

$edipi = '1234567890'                # 10-digit number on the CAC
$filter = "userPrincipalName -like '$edipi@*'"

# Forest-wide UPN search
$results = foreach ($domain in (Get-ADForest).Domains) {
    Get-ADUser -Server $domain -Filter $filter `
        -Properties DisplayName,SamAccountName,UserPrincipalName,Enabled,DistinguishedName |
    Select-Object DisplayName,SamAccountName,UserPrincipalName,Enabled,DistinguishedName,
                  @{n='Domain';e={$domain}}
}
$results

# Flag duplicate UPNs (useful when a number was applied to the wrong account)
$dupes = $results | Group-Object UserPrincipalName | Where-Object Count -gt 1 |
         Select-Object -ExpandProperty Group
$dupes

# If your environment uses certificate mapping, check for the number there too
Get-ADUser -LDAPFilter "(altSecurityIdentities=*${edipi}*)" `
    -Properties altSecurityIdentities,UserPrincipalName,SamAccountName,DisplayName |
Select-Object DisplayName,SamAccountName,UserPrincipalName,altSecurityIdentities

Tips:

  • If you only have the number and nothing turns up, also try: Get-ADUser -Filter "SamAccountName -eq '$edipi'" -Properties *.
  • Watch for leading zeros and stray spaces; normalize with $edipi = $edipi.Trim().
  • To speed things up, add -SearchBase "OU=Users,DC=example,DC=com" if you know the OU.
  • If you just fixed a misapplied UPN, allow for AD replication before re-running the search so results are consistent across domains.

Recommended Answers

All 2 Replies

Member Avatar for cguan_77

Hi Radio2006, check out this link it shows how to use UPN as an input to query active directory. Hope it helps. :)

Member Avatar for Radio2006

I thought I had marked this question as solved. Using the Get-ASUser function in powershell, as cguan 77 suggested in th link, was the trick to find the other user that had the incorrect number assigned to their account. Not sure how they were functionin that way as every number is supposed to be different. Thanks again.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.