Powershell, чтобы получить любой объект AD с атрибутом msDS-GroupManagedServiceAccount не пустым?

Question

Как я могу получить групповые управляемые учетные записи служб в моей Active Directory? https://docs.microsoft.com/en-us/windows-server/security/group-managed-service-accounts/group-managed-service-accounts-overview

Поскольку при использовании Powershell ниже он ничего не возвращает?

$Properties = @(
    'msDS-GroupManagedServiceAccount',
    'msDS-AllowedToDelegateTo',
    'msDS-KeyVersionNumber',
    'msDS-PrincipalName',
    'MemberOf',
    'CanonicalName',
    'servicePrincipalName',
    'servicePrincipalNames',
    'UserPrincipalName',
    'whenChanged',
    'whenCreated',
    'accountExpires'
    'lastLogon',
    'LastLogonDate',
    'lastLogonTimestamp',
    'LockedOut',
    'logonCount',
    'pwdLastSet'
)

$SelectProperties = @(
    'DisplayName', 
    'UserPrincipalName',
    'MemberOf',
    'LockedOut',
    'logonCount',
    'whenChanged',
    'whenCreated',
    'msDS-GroupManagedServiceAccount',
    'msDS-AllowedToDelegateTo',
    'msDS-KeyVersionNumber',
    'msDS-PrincipalName'

)

$CalculatedProps = @(
    @{n = 'OU Canonical Path'; e = { $_.CanonicalName.Remove($_.CanonicalName.LastIndexOf($_.Name) - 1) } },
@{n = "MemberOf";e={ ((-join (($_.memberof.split(',')) -like "*cn=*") ) -replace 'CN=',",").TrimStart(",")  }},
    @{n = 'Last Logon'; e = {[datetime]::FromFileTime($_.lastLogon)}},
    @{n = 'LastLogonTimeStamp'; e = {[datetime]::FromFileTime($_.LastLogonTimeStamp)}},
    @{n = 'Account Expired Time'; e = {[datetime]::FromFileTime($_.accountExpires)}},
    @{n = 'Password Last Set'; e = {[datetime]::FromFileTime($_.pwdLastSet)}},
    @{n = "OU" ; e = { $_.Distinguishedname | ForEach-Object { ($_ -split '(OU=)', 2)[1, 2] -join '' } } },
    @{n = "PrimarySMTPAddress" ; e = { ( $_.proxyAddresses | ? { $_ -cmatch "SMTP:*" }).Substring(5) -join ";" } },
    @{n = "smtp" ; e = { ( $_.proxyAddresses | ? { $_ -cmatch "smtp:*" }).Substring(5) -join ";" } }
)

Get-ADUser -Filter {(Enabled -eq $true) -and (msDS-GroupManagedServiceAccount -neq $null)} -Properties $Properties | 
    Select-Object ($SelectProperties + $CalculatedProps) | Out-GridView

Код ошибки:

Get-ADUser : Error parsing query: '(Enabled -eq $true) -and (msDS-GroupManagedServiceAccount -neq $null ) ' Error Message: 'Operator Not supported: -neq' at position: '59'.
At line:1 char:1
+ Get-ADUser -Filter {(Enabled -eq $true) -and (msDS-GroupManagedServic ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ParserError: (:) [Get-ADUser], ADFilterParsingException
    + FullyQualifiedErrorId : ActiveDirectoryCmdlet:Microsoft.ActiveDirectory.Management.ADFilterParsingException,Microsoft.ActiveDirectory.Management.Commands.Get ADUser