How to get list of groups with no ManageBy from a specific OU in Active Directory with Powershell

Question

Hopefully someone can help me out. I am trying to get into a specific Organizational Unit which contains multiple groups and I want to display the ones that has a blank ManageBy field. The problem I don't know how to overcome mostly is how to get all the groups out of the OU I don't need or want the actual users of the groups just the groups the name of the groups and the ones without a ManageBy field from that OU. I know how to get groups and show their names by doing.

Get-ADGroup -Filter 'Names "*"'

This would just list all the groups in the whole Active Directory not just the specific OU and I don't know how to filter only the ones that have a blank ManageBy field. The only thing I can think of for getting the groups with no ManagedBy is this

Get-ADGroups | Where-Object {$_.ManagedBy -eq $null)

The only other thing I could think of was to create a variable and assign it a specific OU and then get the groups from that variable.

But I don't know if that's even possible to work. I am really new to PowerShell and Active Directory so any help would be great. If someone could help me out with this I would appreciate it.

Answer 1

Performing a simple Get-Help Get-ADGroup -Full (or going to this link) would probably give you the answer you're looking for, but for the sake of others possibly wanting this information you can use the -SearchBase parameter to specify an OU to search.

Get-ADGroup -Filter * -SearchBase 'OU=My OU,DC=TacoTruck,DC=org'

If you do not want to include any child OU's then you would also want to specify -SearchScope 0.

Answer 2

If you're going to use Where-Object, you need to ask Get-ADGroup to return the ManagedBy property by using the -Properties parameter. Otherwise, it'll always be null.

Get-ADGroup -Filter * -Properties ManagedBy -SearchBase "OU=My OU,DC=TacoTruck,DC=org" | Where-Object {$_.ManagedBy -eq $null}

However, if you pipe the results into Where-Object, you are asking AD for more than you need. You're getting every group in the OU, then you're discarding some of the results. It'll work, it's just unnecessary traffic.

This will ask AD for only what you need:

Get-ADGroup -LDAPFilter "(!managedBy=*)" -SearchBase "OU=My OU,DC=TacoTruck,DC=org"