# Only display OU without CN

**URL:** <https://forums.powershell.org/t/only-display-ou-without-cn/9219>\
**Category:** PowerShell Help\
**Created:** [August 22, 2017, 1:14pm UTC](https://forums.powershell.org/t/only-display-ou-without-cn/9219 "2017-08-22T13:14:39Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![imahnobody](https://avatars.discourse-cdn.com/v4/letter/i/a5b964/32.png) [@imahnobody](https://forums.powershell.org/u/imahnobody)\
**Post date:** [August 22, 2017, 1:14pm UTC](https://forums.powershell.org/t/only-display-ou-without-cn/9219/1 "2017-08-22T13:14:39Z")

</div>

I am running the below script and have been trying for several hours to get only the OU structure of a computer object, but without the CN:

```
$OUin=@('jelly','eggs','carrots')
$OUex='cheese|yogurt|bananas'

foreach ($OU in $OUin) {Get-ADOrganizationalUnit -Filter * |Select-Object -ExpandProperty DistinguishedName | Where-Object {$_ -match $OU -and $_ -notmatch ($OUex)}|`
ForEach-Object {Get-ADComputer -SearchBase $_ -SearchScope Onelevel -Filter {Enabled -eq $true}
```

I’ve tries various split operators and split-path cmdlet, but I just can’t seem to get the information I want. Can someone help me out? Thanks.

---

<div class="post-metadata">

**Author:** ![donj](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/donj/32/137_2.png) [@donj](https://forums.powershell.org/u/donj)\
**Post date:** [August 22, 2017, 1:16pm UTC](https://forums.powershell.org/t/only-display-ou-without-cn/9219/2 "2017-08-22T13:16:04Z")

</div>

So, everything up to the “cn=” but not including that? Or just the OUs (not the DCs?)

---

<div class="post-metadata">

**Author:** ![donj](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/donj/32/137_2.png) [@donj](https://forums.powershell.org/u/donj)\
**Post date:** [August 22, 2017, 1:19pm UTC](https://forums.powershell.org/t/only-display-ou-without-cn/9219/3 "2017-08-22T13:19:05Z")

</div>

A problem is that a computer can belong to more than one OU (through nesting), and also to a container (which is a cn=, not an ou=, like the built-in Computers container).

I should also point out that you’re repeatedly querying all the OUs from AD, which isn’t very efficient and could load the domain controller. It’d perhaps be better to query the OUs one time, and then enumerate them to look for matches against your list.

A one-liner isn’t going to be the most efficient or easy-to-write way to do this - rather than chaining commands, it might be better to write a more formal script.

If you could outline the business goal here, it might be easier for me to understand what you’re trying to do, and to offer a useful suggestion?

---

<div class="post-metadata">

**Author:** ![imahnobody](https://avatars.discourse-cdn.com/v4/letter/i/a5b964/32.png) [@imahnobody](https://forums.powershell.org/u/imahnobody)\
**Post date:** [August 22, 2017, 2:13pm UTC](https://forums.powershell.org/t/only-display-ou-without-cn/9219/4 "2017-08-22T14:13:16Z")

</div>

I am supposed to query our AD structure to find specific OU’s with a given name. Based on the DN of that search, I do not want to see certain OU’s with another set of names. Then I want to get a count of all the computer objects in the OU’s based on the previous results. I was gonna use the Group-Object cmdlet to do this. When I group it, I see the CN’s of the DN’s. I just want to see the OU path.

---

<div class="post-metadata">

**Author:** ![donj](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/donj/32/137_2.png) [@donj](https://forums.powershell.org/u/donj)\
**Post date:** [August 22, 2017, 3:34pm UTC](https://forums.powershell.org/t/only-display-ou-without-cn/9219/5 "2017-08-22T15:34:42Z")

</div>

OK. So, with a path like:

```
Dc=mydomain,dc=com,ou=Sales,ou=West,cn=client43
```

What would you want to see?

---

<div class="post-metadata">

**Author:** ![imahnobody](https://avatars.discourse-cdn.com/v4/letter/i/a5b964/32.png) [@imahnobody](https://forums.powershell.org/u/imahnobody)\
**Post date:** [August 23, 2017, 7:23am UTC](https://forums.powershell.org/t/only-display-ou-without-cn/9219/6 "2017-08-23T07:23:22Z")

</div>

The output is in reverse when I get the results:

```
CN=client43,OU=West,OU=Sales,DC=mydomain,DC=com
```
I just want to drop **client43,** and keep **OU=West,OU=Sales,DC=mydomain,DC=com**
```
```

---

<div class="post-metadata">

**Author:** ![pdearmen](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/pdearmen/32/263_2.png) [@pdearmen](https://forums.powershell.org/u/pdearmen)\
**Post date:** [August 23, 2017, 8:22am UTC](https://forums.powershell.org/t/only-display-ou-without-cn/9219/7 "2017-08-23T08:22:15Z")

</div>

While probably not the most elegant solution I’ve used the below for your specific situation:

```
get-adcomputer $($env:computername) |
Select-Object @{
Name = "Parent"; `
Expression = {($_.distinguishedname.split(","))[1 .. $(($_.distinguishedname.split(",") | measure-object).count - 1)] -join ","`
	}
}
```

Translating that into your code:

```
Get-ADComputer -SearchBase $_ -SearchScope Onelevel -Filter {Enabled -eq $true} | 
Select-Object @{ Name = "ParentOU";`
Expression = { ($_.distinguishedname.split(","))[1 .. $(($_.distinguishedname.split(",") | measure-object).count - 1)] -join ","`
} }
```

EDIT:  
I should also point out that this will only work for computer accounts. While at work I don’t have access to my old jobs repo of stuff I wrote - I know I got something in there that would handle user accounts as well but that would have to wait until after work but if your only looking for computer you should be fine.

---

<div class="post-metadata">

**Author:** ![imahnobody](https://avatars.discourse-cdn.com/v4/letter/i/a5b964/32.png) [@imahnobody](https://forums.powershell.org/u/imahnobody)\
**Post date:** [August 23, 2017, 11:32am UTC](https://forums.powershell.org/t/only-display-ou-without-cn/9219/8 "2017-08-23T11:32:49Z")

</div>

Thanks Paul. That’s exactly what I needed. I’m reading about regex, so I can understand what you did.

---

<div class="post-metadata">

**Author:** ![curtis-smith](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/curtis-smith/32/121_2.png) [@curtis-smith](https://forums.powershell.org/u/curtis-smith)\
**Post date:** [August 23, 2017, 10:39pm UTC](https://forums.powershell.org/t/only-display-ou-without-cn/9219/9 "2017-08-23T22:39:11Z")

</div>

What Paul provided was not RegEx, although it could be done with RegEx similar to the following

```
Get-ADComputer -SearchBase $_ -SearchScope Onelevel -Filter {Enabled -eq $true} | 
Select-Object @{ Name = "ParentOU";`
Expression = {[regex]::Match($_.distinguishedname,",(.*)").Groups[1].Value}}}
```

---

<div class="post-metadata">

**Author:** ![froaderick](https://avatars.discourse-cdn.com/v4/letter/f/919ad9/32.png) [@froaderick](https://forums.powershell.org/u/froaderick)\
**Post date:** [August 24, 2017, 6:51am UTC](https://forums.powershell.org/t/only-display-ou-without-cn/9219/10 "2017-08-24T06:51:44Z")

</div>

For dealing with User OUs, I found a regex that handles the occasional comma in the user name:

```
$ou = "CN=Smith\, John,OU=Users,OU=TEST OU,DC=nowhere,DC=com"

$ou -replace '^.+?(?<!\\),', ''
```

should give you “OU=Users,OU=TEST OU,DC=nowhere,DC=com”

---

<div class="post-metadata">

**Author:** ![dotnVo](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@dotnVo](https://forums.powershell.org/u/dotnVo)\
**Post date:** [May 16, 2024, 8:37pm UTC](https://forums.powershell.org/t/only-display-ou-without-cn/9219/11 "2024-05-16T20:37:42Z")

</div>