根据说明

Question

我在Search-ADAccount查询中过滤掉帐户时遇到问题。查询始终返回已启用且已登录至少一次的40天非活动AD帐户。然而，被退回的一些帐户被标记为长期疾病，产假或者帮助台帐户。在用户的对象中，关键字将至少出现一次，因此我使用-notlike来使用通配符函数。但它仍然无效，任何想法都非常感谢！

$excludelist = "Sickness", "Maternity", "Helpdesk"
$users = Search-ADAccount -AccountInactive -TimeSpan (New-TimeSpan -Days 40) -Searchbase "OU=Users,OU=State,DC=Company,DC=Biz" |
         where {($_.enabled -eq $true) -and
                ($_.Description -notlike $excludelist) -and
                ($_.LastLogonDate -notlike $null) } |
         Get-ADUser -Properties mail, manager, LastLogonTimeStamp

更新：根据评论中的帮助，我更新了代码，但过滤不适用。这是完整的代码;

Import-Module ActiveDirectory

#Set our non-changing variables for the email
$SMTPServer = "SMTP-Server@company.de"
$From = "Helpdesk <Helpdesk@company.de>"

#Set Testing if needed
$testing = "Enabled" #Set to disabled to go live
$testRecipient = "adam@company.de"

#Set Description Modifiers:
$excludelist = 'Sickness|Maternity|Helpdesk'

#Query AD for all the NCE accounts with no activity for 40 days and are enabled
$users = Search-ADAccount -AccountInactive -TimeSpan (New-TimeSpan -Days 40) -Searchbase "OU=Users,OU=Company,DC=Company,DC=de" | 
Where-Object {
    $_.Enabled -and
    $_.Description -notmatch $excludelist -and
    $_.LastLogonDate
} | Get-ADUser -Properties mail, manager, LastLogonTimeStamp, description

#Loop through the query results
foreach ($User in $Users) {
    #Convert LastLogonDate to days since last use
    $lastLogon = [DateTime]::FromFileTime($User.lastLogonTimeStamp)
    $Daysinactive = ((Get-Date) - $lastLogon).Days

    #Get manager email with passthrough
    $Manager = Get-ADUser $User.Manager -Properties EmailAddress

    #Set dynamic variables and body of email
    $To = $Manager.EmailAddress
    $Subject = "Your employee $($User.Givenname) $($User.Surname) has not been active since $Daysinactive days."
    $Body = 
    "Hello $($Manager.GivenName),<br>
<p>The account of $($User.Givenname) $($User.Surname) has not been active for $Daysinactive days. Please explain in return email.
<table border='1'>
<tr>
<td>Name</td>
<td>eIPN</td>
<td>email</td>
<td>Inactive Days</td>
<td>Description</td>
<td>Test</td>
</tr>
<tr>
<td>$($User.Givenname) $($User.Surname)</td>
<td>$($User.SamAccountName)</td>        
<td>$($User.mail)</td>
<td>$Daysinactive</td>
<td>$($User.Description)</td>
<td>$excludelist</td>
</tr>
</table>
<p>Thanks you.<br>
<p>IT Helpdesk"

    #Testing check before email is sent
    if (($testing) -eq "Enabled") {
        $To = $testRecipient
    } # End Testing

    #Send email
    Send-MailMessage -To $To -From $From -Subject $Subject -SmtpServer $SMTPServer -Body $Body -BodyAsHtml -Priority High
}

要进行测试，我已将$($User.Description)和$excludelist添加到电子邮件表格中，以确保正在阅读这些值。

应该被过滤的用户正在返回一个表，例如：

所以我可以看到user.description正在阅读其中包含排除的“帮助台”字样，但它不会过滤。

我还尝试将$exludelist设置为“帮助台”，但这也不会过滤。

感谢任何帮助。我已经尝试过编写我可以在网上找到的过滤方法的每种方法，但仍然没有运气！

Answer 1

条件<value> -notlike <list>不起作用。 -notlike运算符（以及-like运算符）只能将值与通配符模式的另一个值进行比较。此外，您只需要在描述中既没有给定字符串的项目，所以您必须像这样定义过滤器：

Where-Object {
  $descr = $_.Description
  -not ($excludelist | Where-Object {$descr -like "*$_*"})
}

如果要检查某个属性是否包含任何给定的字符串列表，则使用正则表达式和-notmatch运算符会更简单。此外，Search-ADAccount不返回的对象的属性包括属性description，因此您无法在运行Get-ADUser之前对该属性进行过滤（您必须指示获取该属性）。您可能想要做的另一件事是将参数-UsersOnly添加到Search-ADAccount以防止它获取计算机帐户等。

将您的代码更改为：

$excludelist = 'Sickness|Maternity|Helpdesk'
$users = Search-ADAccount ... -UsersOnly |
         Where-Object { $_.Enabled -and $_.LastLogonDate } |
         Get-ADUser -Properties mail, manager, LastLogonTimeStamp, Description |
         Where-Object { $_.Description -notmatch $excludelist }

Answer 2

-like运算符与数组的右手参数不兼容：

PS C:\> "a" -notlike "a","b"
True

由于-like（或任何变体，包括-notlike）需要右侧的字符串，因此它会将数组转换为单个字符串，因此您的过滤器会有效变为：

$_.Description -notlike "Sickness Maternity Helpdesk"

我怀疑这会排除任何人：）

您可以改为使用-contains运算符：

$excludelist -notcontains $_.Description

或-in运算符（PowerShell 3.0或更高版本）：

$_.Description -notin $excludelist