Get-QADObject

Display-Name (displayName) 
Given-Name (givenName) 
Legacy-Exchange-DN (legacyExchangeDN) 
ms-DS-Additional-Sam-Account-Name (msDS-AdditionalSamAccountName) 
Physical-Delivery-Office-Name (physicalDeliveryOfficeName) 
Proxy-Addresses (proxyAddresses) 
RDN (name) 
SAM-Account-Name (sAMAccountName) 
Surname (sn) 

For instance, when you supply 'ann*' as the value of this parameter, the cmdlet searches for objects that have ann at the beginning of the value of at least one of the attributes listed above.

For instance, with the value of this parameter set to 'memberOf', the cmdlet searches the collection of the groups to which the SearchRoot object belongs.

The parameter value is a hash table that defines the names and values of the request controls to be passed to ActiveRoles Server. The parameter syntax is as follows:

   -Control @{<name> = <value>; [<name> = <value>] ...}

In this syntax, each of the name-value pairs is the name and the value of a single control. For instructions on how to create and use hash tables, see topic "about_associative_array" or "about_hash_tables" in Windows PowerShell Help. For information about ActiveRoles Server request controls, refer to ActiveRoles Server SDK documentation.

Note that this parameter only has an effect on the operations that are performed through ActiveRoles Server (connection established using the Proxy parameter); otherwise, this parameter causes an error condition in ActiveRoles Management Shell.

- The values of the Integer8 attributes listed in the 
  Integer8AttributesThatContainDateTimes array 
  (see the parameter descriptions for the 
  Get-QADPSSnapinSettings and Set-QADPSSnapinSettings
  cmdlets) are converted from IADsLargeInteger to DateTime

- The values of the Integer8 attributes listed in the 
  Integer8AttributesThatContainNegativeTimeSpans array 
  (see the parameter descriptions for the 
  Get-QADPSSnapinSettings and Set-QADPSSnapinSettings
  cmdlets) are converted from IADsLargeInteger to TimeSpan

- The values of the other Integer8 attributes are 
  converted from IADsLargeInteger to Int64

- The values of the OctetString attributes are converted
  from byte[] to BinHex strings

Note: This parameter has an effect only on the properties of the output object that have the member type of NoteProperty. Such properties are normally added to the output object in order to provide access to the attribute values of the respective directory object that are loaded to the local memory cache but cannot be accessed by using properties of the base object (the object for which the output object serves as a wrapper).

Note: If a cmdlet does not cache a particular attribute, then the output object returned by the cmdlet may not have a property that would provide access to the value of the attribute.

Note: If a cmdlet does not cache a particular attribute, then the output object returned by the cmdlet may not have a property that would provide access to the value of the attribute.

The cmdlet attempts to find the object that is identified by the value of this parameter, disregarding the other parameters. If you want other parameters to have effect, do not supply any value of this parameter on the command line.

Note: Caching an attribute guarantees that the value of the attribute can be read by using properties of the output object returned by the cmdlet.

Note that the lastKnownParent attribute is only set if the object was deleted on a domain controller running Windows Server 2003 or later version of Microsoft Windows Server. Therefore, it is possible that the lastKnownParent attribute value is inaccurate.

The cmdlet disregards this parameter if an Identity value is supplied. If you want this parameter to have effect, do not supply any Identity value on the command line. Instead, supply a SearchRoot value.

If you supply the LdapFilter parameter along with attribute-specific parameters, then your search returns objects that meet the conditions defined by the LDAP filter and have the specified attributes set to the specified values.

Normally, the default page size is 50. You can view or modify this default setting by using the Get-QADPSSnapinSettings or Set-QADPSSnapinSettings cmdlet, respectively.

- A domain is supplied as the SearchRoot parameter value.
- Active Directory Recycle Bin is enabled in that domain.

You can use this parameter in conjunction with the Tombstone parameter for the search results to include both the deleted and recycled objects that meet the search conditions. Without this parameter, the cmdlet returns only deleted objects.

Note: Caching an attribute guarantees that the value of the attribute can be read by using properties of the output object returned by the cmdlet. If a particular attribute is not in the cache, the output object may not have a property that would provide access to the value of the attribute.

@{attr1='val1';attr2='val2';...}

In this syntax, each of the key-value pairs is the LDAP display name and the value of an attribute to search. A value may include an asterisk character - a wildcard representing any group of characters. For information about associative arrays, type the following command at the PowerShell command-prompt:

help about_associative_array

The search criteria are defined by the LdapFilter parameter value and the values of attribute-specific parameters.

The cmdlet disregards this parameter if an Identity value is supplied. If you want this parameter to have effect, do not supply any Identity value on the command line.

  'Base'     Limits the search to the base (SearchRoot) object.
             The result contains a maximum of one object.
  'OneLevel' Searches the immediate child objects of the base (SearchRoot)
             object, excluding the base object.
  'Subtree'  Searches the whole sub-tree, including the base (SearchRoot)
             object and all its child objects.

Normally, if this parameter is not supplied, the cmdlet performs a Subtree search. You can view or modify this default setting by using the Get-QADPSSnapinSettings or Set-QADPSSnapinSettings cmdlet, respectively.

The following values are permitted for this object type.

   'None' - do not retrieve any security data
   'Owner' - retrieve the owner data
   'Group' - retrieve the primary group data
   'Dacl' - retrieve the discretionary access-control list data
   'Sacl' - retrieve the system access-control list data

You can supply a combination of these values, separating them by commas. For example, you can supply the parameter value of 'Dacl,Sacl' in order to retrieve both the discretionary and system access-control list data.

The following values are permitted for this object type.

In a domain with Active Directory Recycle Bin (a feature of Windows Server 2008 R2) this parameter retrieves deleted objects (rather than tombstones, which in that case are referred to as recycled objects). Recycle Bin preserves all attributes on the deleted objects, so you can use a search filter based on any attributes.

In a domain without Active Directory Recycle Bin, deleting an object converts that object to a tombstone. A search using this parameter returns tombstone objects that meet the filtering criteria supplied. Upon deletion of an object only a small number of the object's attributes are saved in the tombstone, with most of the attributes being lost. To search for deleted objects, your search filter should be based on the attributes that are preserved in tombstones.

When the Tombstone parameter is supplied, the search results include the deleted objects or tombstones that match the specified search filter. However, a search filter that matches a live object may not work as expected after the object is deleted. This is because not all attributes are retained in the tombstone. For example, a filter such as (&(objectClass=user)(objectCategory=person)) would not match any tombstone objects since the objectCategory attribute is removed upon object deletion. Conversely, the objectClass attribute is retained on tombstone objects, so a filter of (objectClass=user) would match deleted user objects.

The name of a tombstone object begins with the name of the deleted object, so a search using the Tombstone parameter can be refined by adding a filter based on object name. For example, to search for deleted objects with a name that begins with "John", you can use a filter such as (cn=John*).

It is also possible to find a specific deleted object. If you know the name of the object and the Distinguished Name (DN) of the container the object was in before it was deleted, then you can pass the container's DN to the LastKnownParent parameter and apply a filter of (cn=<name of the object>*) in order to have the cmdlet retrieve that specific object. However, if an object is deleted, a new object with the same DN is created, and then deleted as well, the above search would return more than one object. The returned objects are distinguished by the GUIDs of the deleted objects, with the name of each ending in the GUID of the respective deleted object.

Note: If a cmdlet does not cache a particular attribute, then the output object returned by the cmdlet may not have a property that would provide access to the value of the attribute.

The 'PowerShell' value causes the cmdlet to use PowerShell wildcards and quoting rules. Wildcards are processed on the client side, which may result in slow search performance.

For information about PowerShell wildcards and quoting rules, type the following commands at the PowerShell command-prompt:

   help about_wildcard
   help about_quoting_rule

The 'LDAP' value causes the cmdlet to use LDAP wildcards (asterisks only) and LDAP quoting rules (backslash as the escape character). Wildcards are processed on the server side, which enables faster search results.