In this case, I was searching for AD users with populated proxyaddresses property, but with missing email address from specific domain. For example: a user was having following email addresses:
user@domain-a.com and
user@domain-c.com, but was missing the
user@domain-b.com. I wrote a singleliner PowerShell for listing those users:
Get-ADUser -LDAPFilter "(&(proxyAddresses=*)(!proxyAddresses=smtp:*domain-b.com))" -Properties * | ? {$_.enabled -eq $true } | ft name,proxyaddresses -AutoSize -Wrap
Also, there was one more condition that users with missing email address have to be enabled.
I hope that this singleliner Powershell will help you in a quest for missing email addresses.