adaz posted:

We don't use logon to around here and as you said searching for it's a bitch. I do what I always do when trying to find a obscure LDAP/AD setting - I set it up on an AD object and bind it to the object in powershell:

code:

$User = [adsi]"LDAP://cn=test,ou=users,ou=blah,dc=local,dc=com"

Then I did a $User | GM to see all the properties that were set on the object... and what is this?

$User.UserWorkstations - that's promising. I check out the MSDN article on it (http://msdn.microsoft.com/en-us/library/ms680868%28v=VS.85%29.aspx) and lo and behold this is exactly what we want. So now all we have to do is create a LDAP search syntax for you. LDAP Search Syntax Is the Best (tm). I usually start here:
http://msdn.microsoft.com/en-us/library/aa746475%28VS.85%29.aspx

I saved you some time and effort and here is the appropriate code:

code:

$root = [ADSI] "LDAP://your.domain"
$searcher = New-Object System.DirectoryServices.DirectorySearcher $root
$searcher.filter = "(&(objectClass=user)(userworkstations=*))"
$users = $searcher.FindAll()

this will return all the users in your domain who have the userworkstations attribute set. You can then iterate through them and do whatever you need:

code:

for($i=0;$i -lt $users.count;$i++) {
  $User = [adsi]"$($users[$i].path.tostring())" # had to add the ToString part, kept crashing my powershell.weird
  $user.putex("1","userworkstations","0")
  $user.setinfo()
  
}