powershell - Why Does Get-ADObject Not Filter ObjectClass="user" Correctly? -

problem

get-adobject -filter {objectclass = "user"} 

returns both users , computers. object classes display correctly "user" or "computer".

get-adobject -filter {objectclass = "computer"} 

returns computers.

other observations

get-adobject "cn=desktop1,cn=computers,dc=contoso,dc=com" ` | get-member -property objectclass 

returns

typename: microsoft.activedirectory.management.adobject  name              membertype            definition ----              ----------            ---------- objectclass       property              system.string objectclass {get;set;} 

furthermore, returns false, expected:

$(get-adobject "cn=desktop1,cn=computers,dc=contoso,dc=com").objectclass -eq "user" 

queries objectclass=user return user and computer objects, because computer class derived user class. if want user objects, filter objectclass=user and objectcategory=person. see here.