Querying AD for users with SmartcardLogonRequired

Question

We are trying to write a script to query AD for all users who are required to logon with a smart card.
The problem we're having is that it is only returning 43 users out of our ~750 that are using smart cards. In AD the checkbox is set and the users' logons are working properly
Here is the command I ran first:
Get-ADUser -Filter {SmartcardLogonRequired -eq $True} -Properties *
When that didn't work I tried this, but got the same result:
Get-ADUser -Filter {userAccountControl -band 262144} -Properties *
Next I looked at individual users. My account is actually returned and when I check the property I get this:
PS > $User = Get-ADUser -Filter {SamAccountName -eq '<REDACTED>'} -Properties *
PS > $User.SmartcardLogonRequired
True
PS >
When checking an account that isn't returned I get nothing back.
PS > $User = Get-ADUser -Filter {SamAccountName -eq '<REDACTED>'} -Properties *
PS > $User.SmartcardLogonRequired
PS >
I have tried un-checking and re-checking that box but that doesn't seem to have any effect. Has anyone come across this before? Any ideas on what to try next?

Answer 1

To query users that are Smart Card Required, your first command was correct:
Get-ADUser -filter {SmartCardLogonRequired -eq $True}
Remember, smart card enabled and smart card required are two different things.  You can have a smartcard and still use username and password, (if the SCRIL box isn't checked).
To set the account to enabled:
Set-ADUser -Identity <name> -SmartCardLogonRequired $true
To turn the requirement off:
Set-ADUser -Identity <name> -SmartCardLogonRequired $false
Remember that when you set the smart card requirement on an account, the NT Hash for the password is changed, meaning the user will no longer know their password.  If you set someone to true, then false, you have scrambled the password.
Also, if you set the requirement to true while the user is logged on, you are changing the NT Password Hash in Active Directory and the user's session will have a bad hash.  Whenever that user tries to perform any NTLM function, they will become locked
out.
Good luck!
- Chris Ream -
**Remember, if you find a post that is helpful, or is the answer, please mark it appropriately.**