How To: Check for Enrolled Users in Passcode/Authenticate Application

Version Affected: All

 

Overview

This article explains how to check which users have enrolled for the SecureAuth Passcode or Authenticate mobile app. A quick way to check is the Audit Log for Realm998, which shows successful enrollments, but this doesn't scale well for a large number of users. This article instead shows how to query Active Directory (AD) directly with PowerShell for a complete list.

Query Active Directory for Enrolled Users

1. On your Domain Controller, open the Active Directory Module for Windows PowerShell from Administrative Tools.

2. Run the following command, using whichever AD attribute your realm is configured to write the OATH Seed to — for example, postalAddress:

Get-ADUser -Filter * -Properties * | ? {$_.postalAddress -ne $null} | Select-Object CN,SamAccountName,postalAddress

3. Press Enter to run the command. The output lists every AD user who has a value in that attribute — in this case, every user who has completed enrollment.

This same command works for any AD attribute, not just the one tied to OATH Seed enrollment — replace postalAddress in both places in the command with the attribute you want to check, to list every user who has a value populated in it.

 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.