powershell get-aduser where manager -eq disabled

Question

Im trying to get all AD users where the user in the manager field is disabled

The below does not work, ive tried multiple ways though cannot figure it out

Get-ADUser -SearchBase "XXX" -filter {enabled -eq $true} -Properties * | where {Get-aduser -Filter {distinguishedname -eq $_.manager -and enabled -eq $false}}

Answer 1

I don't have an AD readily available that has populated Manager attribute, so the script is not tested. Anyway, a simple way is to create two collections with Get-ADUser . Fill one with all the disabled accounts and one with enabled ones. Loop through the enabled accounts and check if manager is found from the disableds.

To make things faster, store the disabled accounts as a hash table with Group-Object and use hashtable's ContainsKey() method like so,

$disabled = Get-ADUser -filter { enabled -ne $true } | group-object `
    -AsHashTable -AsString -Property Name
$users = Get-ADUser -filter  { enabled -eq $true }

foreach($user in $users) {
  if( $disabled.ContainsKey($user.Manager) ) {
    # User's manager is a disabled account
  }
}