PowerShell for Active Directory

AD group member count - Memory issue

ddan — Fri, 24 May 2013 02:30:54 GMT

Hi Guys,

Im attempting to write a script that does a count of users in specific groups & regions. So basically if the group is part of specific OU then do a Get-QADGroupMember and increment the number of users for that region.

My script works fine but I seem to be running out of memory and the the processing slows right down, I end up having to stop it.

I tried to put a [System.GC]::Collect() in my loop but that didnt seem to help, unless im using it incorrectly, can you pls advise how to make this more efficient memory wise.

Thanks!

Here is a cut down version of my code:

foreach ($Group in $GroupMembers){

switch ($Group)

{

{[Regex]::IsMatch($Group.DN,"(?i)OU=A,OU=X,DC=Y,DC=Z$")} {Get-QADGroupMember -Identity $Group.sAMAccountName -Indirect -Connection $conn -ShowProgress -SizeLimit 0 -DontUseDefaultIncludedProperties -type user | ForEach-Object {$Region1++}}

{[Regex]::IsMatch($Group.DN,"(?i)OU=B,OU=X,DC=Y,DC=Z$")} {Get-QADGroupMember -Identity $Group.sAMAccountName -Indirect -Connection $conn -ShowProgress -SizeLimit 0 -DontUseDefaultIncludedProperties -type user | ForEach-Object {$Region2++}}

{[Regex]::IsMatch($Group.DN,"(?i)OU=C,OU=X,DC=Y,DC=Z$")} {Get-QADGroupMember -Identity $Group.sAMAccountName -Indirect -Connection $conn -ShowProgress -SizeLimit 0 -DontUseDefaultIncludedProperties -type user | ForEach-Object {$Region3++}}

{[Regex]::IsMatch($Group.DN,"(?i)OU=D,OU=X,DC=Y,DC=Z$")} {Get-QADGroupMember -Identity $Group.sAMAccountName -Indirect -Connection $conn -ShowProgress -SizeLimit 0 -DontUseDefaultIncludedProperties -type user | ForEach-Object {$Region4++}}

{[Regex]::IsMatch($Group.DN,"(?i)OU=E,OU=X,DC=Y,DC=Z$")} {Get-QADGroupMember -Identity $Group.sAMAccountName -Indirect -Connection $conn -ShowProgress -SizeLimit 0 -DontUseDefaultIncludedProperties -type user | ForEach-Object {$Region5++}}

{[Regex]::IsMatch($Group.DN,"(?i)OU=F,OU=X,DC=Y,DC=Z$")} {Get-QADGroupMember -Identity $Group.sAMAccountName -Indirect -Connection $conn -ShowProgress -SizeLimit 0 -DontUseDefaultIncludedProperties -type user | ForEach-Object {$Region6++}}

{[Regex]::IsMatch($Group.DN,"(?i)OU=G,OU=X,DC=Y,DC=Z$")} {Get-QADGroupMember -Identity $Group.sAMAccountName -Indirect -Connection $conn -ShowProgress -SizeLimit 0 -DontUseDefaultIncludedProperties -type user | ForEach-Object {$Region7++}}

default {$UnknownRegion += Get-QADGroupMember -Identity $Group.sAMAccountName -Indirect -Connection $conn -ShowProgress -SizeLimit 0 -type user | select {$_.name}, {$_.sAMAccountName}}

}

Want to "nest" a list in another Format-List

rkruse — Tue, 21 May 2013 16:02:52 GMT

I have the command below that will give me a nice display of PrimarySMTP and other SMTP addresses (as well as the X400/500 addresses). The problem is that the proxyAddresses are listed as a long text block and I cannot find a way to display them as a list. Can I output a "Format-List" inside of another "Format-List" to pull this off?

get-qAdUser SamAcctNameHere... |

Select-Object

-Property primarySMTPaddress,@{Name='ListOfOthers';Expression=

{

$_.proxyAddresses -join ","}}

Format-List

Copying user with PowerShell as i copy using mouse right click and copy

predatorsnir — Thu, 23 May 2013 21:25:04 GMT

i need copy user with powershell.

new-aduser snirf -AccountPassword (Read-Host "New Password" -AsSecureString)

But what I need to write to it will copy another user with groups and OU

Thanks to all helpers

List Ad Groups With Same Attributes

ewheeler619 — Wed, 22 May 2013 17:11:01 GMT

Hello I'm wondering how I can user powershell to show me a list of AD groups with the same attributes to locations within the same domain

All Users Report

rishi.vohra — Fri, 19 Apr 2013 09:25:14 GMT

Dear,

I am looking for a script that could generate ALL users report which should include:

DN, CN, FirstName, LastName, DisplayName, Email , TelephoneNumber, Mobile, Description, Office ,pwdLastSet, pwage, whenCreated, strAccountExpirationDate, userAccountControl, lastLogonTimeStamp, Disabled, Itsage, Site

I have a script which does give me few attribute, what Can I add more in my scipt to generate other attributes?

Here's my script:

--------------------------

$NumDays = 0

$LogDir = "e:\script\User-Accounts.csv"

$currentDate = [System.DateTime]::Now

$currentDateUtc = $currentDate.ToUniversalTime()

$lltstamplimit = $currentDateUtc.AddDays(- $NumDays)

$lltIntLimit = $lltstampLimit.ToFileTime()

$adobjroot = [adsi]''

$objstalesearcher = New-Object System.DirectoryServices.DirectorySearcher($adobjroot)

$objstalesearcher.filter = "(&(objectCategory=person)(objectClass=user)(lastLogonTimeStamp<=" + $lltIntLimit + "))"

$users = $objstalesearcher.findall() | select `

@{e={$_.properties.cn};n='Display Name'},`

@{e={$_.properties.samaccountname};n='Username'},`

@{e={[datetime]::FromFileTimeUtc([int64]$_.properties.lastlogontimestamp[0])};n='Last Logon'},`

@{e={[string]$adspath=$_.properties.adspath;$account=[ADSI]$adspath;$account.psbase.invokeget('AccountDisabled')};n='Account Is Disabled'}

$users | Export-CSV -NoType $LogDir

------------------------------------------

Thanks

Compare something in the notes field

Barry2408 — Mon, 13 May 2013 09:18:54 GMT

Hi,

I like to compare a value in the notes field of my Active Directory.

In sample Code:
if (notes field cotains at Office == "branchoffice"){

go on}

else {leave}

Any idea? I dont know how to get the Content ouf of the notes field...

Thanks a lot!

Deploying a msi and registry via GPO

anettaj77 — Mon, 13 May 2013 16:59:08 GMT

I need to write a script that would first install sslvpn client then apply a registry change onto laptops.

Here's the batch file that is not working:

ECHO OFF
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
: INSTALLS Fortinet VPN Client
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

::IF NOT ERRORLEVEL 1 GOTO UNINSTALL
::GOTO END

:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
: IF VPN CLIENT PRESENT - GOTO END - DO NOTHING
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:CHECK IF VPN CLIENT IS PRESENT
IF EXIST "C:\Program Files (x86)\Fortinet\INSTALL1.DAT" GOTO END
IF EXIST "C:\Program Files\Fortinet\INSTALL1.DAT" GOTO END

:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
: INSTALLS VPN CLIENT
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

\\domain name\NETLOGON\dir name\sslvpnclient.msi /quiet

:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
: PLACES INSTALL.DAT FILE AT LOCATION
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

ECHO VPNCLIENT INSTALLED!!! > "C:\Program Files\Fortinet\INSTALL1.DAT"
ECHO VPNCLIENT INSTALLED!!! > "C:\Program Files (x86)\Fortinet\INSTALL1.DAT"

:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
: Run the Registry File
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

regedit.exe "\\domainnam\NETLOGON\dir name\registry\test.reg"

Any ideas?

Searching entire AD for disabled accounts

budlight4u — Fri, 26 Apr 2013 14:53:54 GMT

Hello,

I'm new to Powershell. Any assistance in discovering the error or my mistake in the script would be greatly appreciated.

I have a simple PS script that I intend to run and discover all disabled accounts in AD residing in various different OUs.

I run the script with

powershell -ExecutionPolicy ByPass -File script.ps1

Here is the entire script and the error generated is in the bottom of the script



$strfilter = "(&(objectClass=user)(objectCategory=person))"

$objDomain = New-Object System.DirectoryServices.DirectoryEntry

$objSearcher = New-Object System.DirectoryServices.DirectorySearcher
$objSearcher.SearchRoot = $objDomain
$objSearcher.PageSize = 1000
$objSearcher.Filter = $strFilter
$objSearcher.SearchScope = "Subtree"
$objSearcher.PropertiesToLoad.Add("cn") | Out-Null
$objSearcher.PropertiesToLoad.Add("member") | Out-Null
$objSearcher.PropertiesToLoad.Add("proxyAddresses") | Out-Null
$objSearcher.PropertiesToLoad.Add("displayName") | Out-Null
$objSearcher.PropertiesToLoad.Add("distinguishedname") | Out-Null
$objSearcher.PropertiesToLoad.Add("useraccountcontrol") | Out-Null
 
$users = $objSearcher.FindAll() 
foreach ($user in $users) 
{ 
"Testing $($user.properties.item(""distinguishedname""))"
"UAC: $($user.useraccountcontrol)" 
if($user.useraccountcontrol -band 2)  
{ write-host -foregroundcolor red "`t account is disabled" }  
ELSE  
{ write-host -foregroundcolor green "`t account is not disabled" } 

}





PS C:\> powershell -ExecutePolicy ByPass -file .\gcnaccounts.ps1
Missing expression after unary operator '-'.
At line:1 char:2
+ - <<<< ExecutePolicy ByPass -file .\gcnaccounts.ps1
    + CategoryInfo          : ParserError: (-:String) [], ParentContainsErrorRecordException
    + FullyQualifiedErrorId : MissingExpressionAfterOperator

PS C:\>

Need help in getting a special AD Group

Barry2408 — Wed, 08 May 2013 12:42:20 GMT

Hi experts ;-)

I'm having a Problem with searching a special Active Directory Group:

I've build two Groups: Info and Test. Info is a Distribution Group. Test a Security Group.

I tried to get the Info Group by using: 1. Get-ADGroup -Identity Info and 2.Get-ADGroup -Identity Test

Results:

1. Cannot find an object with identity: 'Info' under: 'DC=example,DC=de'

2. Works fine and Shows me the Group Infos.

So, is there a difference by using Get-ADGroup for Security Groups and Distribution Grpups?

Thanks a lot for your hel!

Help with Get-ADComputer

hQWeedEater — Tue, 07 May 2013 17:21:05 GMT

This is the bit I run

get-adcomputer -SearchBase "OU=Department,DC=Company,DC=de,DC=us" -filter "Passwordlastset -lt '2/7/2013'" -properties *| Select name,distinguishedName,passwordlastset | Export-Csv "C:\Report.csv" -notypeinformation

Using DistinguishedName it returns something like

CN=ZJIC-8VZQPC1,OU=Department,OU=Company,DC=My,DC=domain

Is it possible to to have it only return the OU's and not the DC's and CN? Or even better have it pull only the department OU information into the CSV?

I'm very new to PowerShell so any advice would be greatly appreciated.

Reset domain user and unlock

Efe — Thu, 02 May 2013 11:43:50 GMT

Hi, I have a problem I need a script that can reset the password to unlock a domain user.
Do it from a form with buttons.

Thanks for the help

$null as string instead of verbal from csv

eizhak9 — Tue, 30 Apr 2013 09:48:00 GMT

Import-module ActiveDirectory

Import-CSV "C:\info2.csv" | % {

$User = $_.dname

$OfficePhone = $_.OfficePhone

$MobilePhone = $_.MobilePhone

$departmen = $_.departmen

$Fax = $_.Fax

Set-ADUser $User -OfficePhone $OfficePhone -MobilePhone $MobilePhone -departmen $departmen

# Next PowerShell Command need Quest Add-in

Set-ADUser $User -Fax $Fax -HomePhone $null

Set-QADUser $User -facsimileTelephoneNumber $Fax

}

here is some of the csv ,

dname	departmen	OfficePhone	MobilePhone	Fax
someone	BO	+972-3-xxxxx	$null	+972-3-xxxxx

Normal 0 false false false EN-US X-NONE HE

now the MobilePhone is blank if i leave it blank i get error, and on oder users i just want to wipe there info so i lay the null,

if i just use "Set-ADUser $User -Fax $Fax -HomePhone $null" it work grate but the problame with MobilePhone is that some employed dont have MobilePhone and so have, and power shell aperntly use the $null in csv as a string.

Normal 0 false false false EN-US X-NONE HE

Need listing of who is not a member of one of several groups

Sproe — Mon, 22 Apr 2013 21:07:42 GMT

We have a number of groups that are tied to Group Policy Preferences that map drives, one each of these groups and policies per department. What I need to know is who is not a member of any of those groups, thus not getting any mapped drives policy.

All of the groups start with "MappedDrives", for instance I belong to MappedDrives-IS. If I were going to address this in English, I'd say, who is not a member of any group starting with MappedDrives.

How would I do that in the Active Directory module of PowerShell?

UserLastLogon - In a txt file

rishi.vohra — Tue, 23 Apr 2013 11:35:59 GMT

Hi All,

I am trying to get Users Last Logon using a test file in which I have users SAM accounts

Below is my script-

----------------------------------------

import-csv users.csv | Get-QADUser -id {$_.csvColumnName} | select name,LastLogonTimestamp|
export-csv users1.csv

-----------------------------------------------

But this is not working. Can somebody help

Execute adamsync from another host

svizzero81 — Wed, 17 Apr 2013 16:38:51 GMT

Hi all,

How can I remotely execute adamsync command?

Use the following command:

Invoke-Command -ComputerName hostname -SCriptBlock {c:\Windows\ADAM\adamsync /sync hostname:389 "ou=people,dc=example,dc=com" /creds DOMAIN Administrator Password} -Credential $cred

Error Logs:

Ldap error occured. ldap_get_next_page_s: Operations Error.

Extended Info: 000004DC: LdapErr: DSID-0C0906E8, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v1db1.

If I run my script locally:

c:\Windows\ADAM\adamsync /sync hostname:389 "ou=people,dc=example,dc=com" /creds DOMAIN Administrator Password

It works correctly.

Marco

Delete Bulk Computers

rishi.vohra — Mon, 15 Apr 2013 15:10:26 GMT

Hi Dear,

I am looking for a way to delete multiple computer objects from a txt file.

I was able to get script to Disable Bulk Computers, but I am finding it hard to get for deletion

I have been trying with VBscript but not 100% satisfied with it

Can you please help?

Get User run as services from computers in Active directory | need help with error

eizhak9 — Tue, 09 Apr 2013 09:10:03 GMT

i have this scriptworking grate

i wish to echo the computers name that have this error

Get-WMIObject : The RPC server is unavailable. (Exception from HRESULT: 0x800706BA)
At C:\c\Get-Services-RunAs-User-From-AD.ps1:17 char:1
+ Get-WMIObject Win32_Service -ComputerName $strComputer | Where-Object{$_.StartNa ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (:) [Get-WmiObject], COMException
+ FullyQualifiedErrorId : GetWMICOMException,Microsoft.PowerShell.Commands.GetWmiObjectCommand

by echo the $strComputer as the real name in the loop

here is the script it working 100 % (you my need to open RPC and WMI i use PSexec withthis command:

PsExec @filterterd.txtt netsh firewall add portopening TCP 135 RPC enable subnet )

#start of the code :

$username = read-host "Set User Name like admin With no Space"

Import-Module activedirectory
If (Test-Path .\AllWindows.csv) { Remove-Item AllWindows.csv }

Get-ADComputer -Filter * -Property * | Where-Object{$_.OperatingSystem -like '*server*' } | Select-Object Name,OperatingSystem,OperatingSystemServicePack,OperatingSystemVersion | Export-CSV AllWindows.csv -NoTypeInformation -Encoding UTF8

$comp = import-csv .\AllWindows.csv
$comp.name >filterterd.txt

If (Test-Path .\resulet.txt) { Remove-Item resulet.txt }

Import-CSV .\AllWindows.csv | % {
$strComputer = $_.name
Get-WMIObject Win32_Service -ComputerName $strComputer | Where-Object{$_.StartName -match $username } | Sort-Object -Property StartName | Format-Table SystemName, Name, StartName, Description -auto -ErrorAction SilentlyContinue | Out-File resulet.txt -Encoding utf8
}

#end code

using Quest CMDlets to return all groups that contain disabled users

Ands7 — Wed, 12 Dec 2012 17:09:19 GMT

Hi all, i have a new question :)

i wish to return all the groups in a domain that have disabled members. I've looked at doing this via Get-Qadgroup | Get-Qadgroupmember but i couldn't get it to work. So i ended up doing it this way instead:

get-qaduser

this sort of works in that I get a list of disabled users and their memberof value - this may not be ideal in that i don't get their indirect list of groups.
-SearchAttributes @{useraccountcontrol="514"} | Select-Object -Property samaccountname,useraccountcontrol,memberof

However, if i add the following to the end I get a System.Object instead of the value. is there something i need to do to export this properly?

| Export-Csv -notype usersUAC.csv

many thanks as always everyone! :)

Andrew

Foreach assistence with import-csv

tac306 — Wed, 10 Apr 2013 19:14:29 GMT

Hello...I am somewhat new to the PS inner workings and thought I could ease my way into it by tackling, what I hoped, would be a simple starting project.

We have a multitude of AD users who, during the onboarding process, did not get home directories or drives assigned. The folders and permissions have actually been created so it's a somewhat simple process of using the set-aduser -homedirectory -homedrive.

I have exported the affected users into a txt file in which it just lists their name (which is their loginID). No filtering is needed on it. What I'm trying to do is create a variable called $name and have that pull the name of each item from the txt file and use in the get and set-aduser commands.

What I have so far is:

Import-Module ActiveDirectory

$namefile = "c:\scripts\homedirectory\users.txt"

$name = Import-Csv $namefile | foreach ??????

Get-ADUser -Identity $name |

Set-ADUser -HomeDirectory "\\server\path\$name" -HomeDrive "I:"

Am I going about this in the right way? I figure the foreach command is what I need just can't seem to get it right.

Thanks in advance to anyone who can assist.

Theres gota be a better way! ??? GetADGroupMember

ddan — Tue, 09 Apr 2013 07:14:54 GMT

Hi, I need to write a script that will go through an AD-group and get all the users from its sub-groups. For each user I require the following details:

distinguishedName

upn

name

samaccountname

2x business related attributes

The details need to be pumped to a csv file.

The problem is the group currently has circa 200K users and it is envisaged that will eventually get out to 1.2Mill users!

Running get-adusergroupmember is good, but has restrictions (and does not seem to get me all the object info i need). So I wrote a script that combines get-adusergroupmember to populate sub-groups and then use an ldap lookup to grab the user info.

I am a relative novice when it comes to PS so wanted to ask the guru's out there for advice on how to make it more efficient? or if I am on the right track. My script thus far declares a shedload of variables and im wondering if theres gota be a better way??? My script is below, note I have cut out alot of the variables and lines as its so repitive and too long. I will end up having a line(and assoc variables) for each letter of the alphabet. Hope that makes sense. Thanks in advance!

$GroupMembers = @()

$SubGroupMembers1 = @()

$SubGroupMembers4 = @()

$SubGroupMembersA = @()

$SubGroupMembersB = @()

$SubGroupMembersC = @()

$SubGroupMembersD = @()

$GroupNames1 = @()

$csvA = @(); $csvB = @();$csvC = @(); $csvD = @()

remove-item C:\Scripts\results_1.csv -force

$GroupMembers = Get-ADGroupMember -identity "group name"

if($GroupMembers)

{

foreach ($member in $GroupMembers){$SubGroupMembers1 += Get-ADGroupMember -identity $member.SamAccountName}

}

if($SubGroupMembers1)

{

foreach ($member1 in $SubGroupMembers1)

{

switch ($member1)

{

{$member.name -like "a*"} {$SubGroupMembersA += Get-ADGroupMember -identity $member1.SamAccountName -recursive}

{$member.name -like "b*"} {$SubGroupMembersB += Get-ADGroupMember -identity $member1.SamAccountName -recursive}

{$member.name -like "c*"} {$SubGroupMembersC += Get-ADGroupMember -identity $member1.SamAccountName -recursive}

{$member.name -like "d*"} {$SubGroupMembersD += Get-ADGroupMember -identity $member1.SamAccountName -recursive}

#switch statement will continue for each letter of the alphabet

default {Write-Host “Unknown Group”}

}

foreach ($memberA in $SubGroupMembersA) {$csvA += [ADSI] "LDAP://$memberA"| select {$_.name}, {$_.sAMAccountName}, {$_.Attribute1}, {$_.userPrincipalName}, {$_.Attribute2},{$_.distinguishedName}}

foreach ($memberB in $SubGroupMembersB) {$csvB += [ADSI] "LDAP://$memberA"| select {$_.name}, {$_.sAMAccountName}, {$_.Attribute1}, {$_.userPrincipalName}, {$_.Attribute2},{$_.distinguishedName}}

foreach ($memberC in $SubGroupMembersA) {$csvC += [ADSI] "LDAP://$memberA"| select {$_.name}, {$_.sAMAccountName}, {$_.Attribute1}, {$_.userPrincipalName}, {$_.Attribute2},{$_.distinguishedName}}

foreach ($memberD in $SubGroupMembersA) {$csvD += [ADSI] "LDAP://$memberA"| select {$_.name}, {$_.sAMAccountName}, {$_.Attribute1}, {$_.userPrincipalName}, {$_.Attribute2},{$_.distinguishedName}}

#foreach statement will continue for each letter of the alphabet

$csvA | Export-Csv -NoTypeInformation c:\scripts\results_A.csv

$csvB | Export-Csv -NoTypeInformation c:\scripts\results_B.csv

$csvC | Export-Csv -NoTypeInformation c:\scripts\results_C.csv

$csvD | Export-Csv -NoTypeInformation c:\scripts\results_D.csv

#csv's created for each letter of the alphabet

Get-QADObject Memory Issues

Sam — Thu, 04 Apr 2013 18:00:27 GMT

Good Afternoon,

I'm tried looking around the web for this issue, but have not been able to find a definite solution.

QUICK OVERVIEW: My company had to change email servers. In the process we migrated just under 4,000 users to the new email system. As a transition phase during the migration a contact was created for each user with the new email address. The user account was then pointed to forward mail to this contact. I wrote a Powershell 3.0 script using the Quest AD Module to delete the contacts and update the corresponding user account with the new email information. The script works excellent on a small scale, but starts throwing "Out of Memory" errors when it gets to about 600+ users. I'm not sure what I'm missing or how to catch / fix this memory leak. Any recommendations would be greatly appreciated.

ATTEMPTED SOLUTIONS: The script initually did everything under 1 function: export the contacts with all attributes (my failsafe in case something went horribly wrong), found the user account that corresponds to the contact, exported user info (again failsafe), deleted contact, updated user, export the user with the new settings. After reading on the few forums I found that were relevant, I tried implementing Clear-Variable, [GC]::Collect(), Remove-Variable throughout the script, but did not see any impact on the memory usage. Under this initial script, I was using about 1.6GB of RAM about 1/3 into the script. The code for the script I'm posint below is version 6. In this one I'm Including all properties on my queries for the export purposes. In previous versions I was only selecting the properies I needed, but then had to do another Get-QADObject/User with full properties for the export. In the end, the script crashed with the "Out of Memory" error regardless of whether I was getting all properies or only the selected ones. I also played around with different PageSize settings and setting it to 25 seemed to speed the process up the most, but had no noticeable impact on the memory consumption. In one version of the script I even tried a While (contacts exist) { process accounts with SizeLimit '250'}. During the testing phase I wasn't actually makeing the changes, just moving the contacts to another OU. In theory I though that setting the size limit would fix my issue, but it had no impact to the overall result.

I finally broke the script into functions and pipelined the whole process (see code below: code has been slightly modified to hide true variable values and condense comments and custom messages).

ERROR MESSAGES: These are the error messages I'm receiving. As you can see, the system has plenty of RAM available, but the script is using ~ 1.4GB. I'm not 100% sure what the 2nd part of the error means. I'm assuming that it resulted in the memory running out and the variable not containing any more data for that iteration of the script.

SCRIPT CODE:

#requires -version 3

## Load Quest Snappin

Add-PSSnapin Quest.ActiveRoles.ADManagement -ErrorAction silentlycontinue

## ***** Declare Variables *****

## Containers

$global:contact_OU = "ou=MIGRATION,ou=CONTACTS,ou=OFFICE,ou=DEPT,dc=SUBDOMAIN,dc=DOMAIN,dc=COM"

$global:unmatched_OU = "ou=Unmatched,ou=MIGRATION,ou=CONTACTS,ou=OFFICE,ou=DEPT,dc=SUBDOMAIN,dc=DOMAIN,dc=COM"

## Reporting Variables

$global:report_path = "C:\AD\Email Cleanup"

$global:timeStamp = Get-Date -UFormat "%H%M_%d-%m-%d-%Y"

## Get-QAD Object Splat Variables

$user_splat = @{

OrganizationalUnit = "ou=USERS,ou=DEPT,ou=COMPANY,dc=SUBDOMAIN,dc=DOMAIN,dc=COM"

LdapFilter = "(!(DisplayName=*.ADM))" ## Do not include admin accounts

IncludeAllProperties = $true

SizeLimit = "1"

ShowProgress = $true

} # end $user_splat

$contact_splat = @{

Type = "Contact"

OrganizationalUnit = $contact_OU

LdapFilter = "(mail=*@newEmail.com)"

IncludeAllProperties = $true

SearchScope = "OneLevel"

SizeLimit = "0"

PageSize = "25"

ShowProgress = $true

} # end $contact_splat

## Write-Out colors. Some color variables have been removed to shorten the code being posted.

$gc_colors = @{

ForegroundColor = "Yellow"

BackgroundColor = "DarkGreen"

} # end splat $gc_colors

cls

## ***** Get Reports *****

function Get_Reports ($obj, $fileName) {

## Export the objects

$report = $timeStamp + "_" + $fileName

$obj | Export-Csv "$report_path\$report.csv" -Append -NoTypeInformation

return $obj

} # end function Get_Reports

## ***** Update Users *****

function Process_Users ($contact) {

if (!($user = Get-QADUser @user_splat -LogonName $contact.mailNickname)) {

Write-Host "*******************************************************" @unmatched_colors

Write-Host @unmatched_colors $contact.Name " Could not be matched to a user account."

Write-Host "*******************************************************" @unmatched_colors

try {

#Write-Host "******************* Moving ************************" $contact.Name

Move-QADObject -Identity $contact.Name -NewParentContainer $unmatched_OU -ErrorAction 'Stop' -ErrorVariable $moveError

} catch [System.OutOfMemoryException] {

Write-Warning "Out of RAM"

$errorTime = Get-Date -UFormat "%d-%m-%d-%Y_%H%M"

Write-Host "Memory Error:" $errorTime | Out-File "$report_path\Function_Report_$timeStamp.txt" -Append

Throw "Memory Error"

} catch {

Write-Warning "Error moving contact"

Get_Reports $contact "Error_Unmatched_Users"

} finally {

Get_Reports $contact "Unmatched_Contacts"

} # end finally

} # end if (!(Get-QADUser)

else {

## Set variables

$new_email = $contact.PrimarySMTPAddress

## Generate Report prior to cleanup

Get_Reports $user "Pre-Cleanup_Users"

try {

## Remove contact so that the new email address can be set as the primary address for the user.

Remove-QADObject -Identity $contact.name -Force

## Process user accounts

$user | Set-QADUser -ObjectAttributes @{altRecipient=''; msExchHomeServerName=''; homeMDB=''; targetAddress="$new_email"}`

| Add-QADProxyAddress -Type "SMTP" -Address $new_email -Primary `

| Remove-QADProxyAddress -Pattern "*@oldemail1.com"`

| Remove-QADProxyAddress -Pattern "*@oldemail2.com"

} catch [System.OutOfMemoryException] {

Write-Warning "Out of RAM"

$errorTime = Get-Date -UFormat "%d-%m-%d-%Y_%H%M"

Write-Host "Memory Error:" $errorTime | Out-File "$report_path\Function_Report_$timeStamp.txt" -Append

Throw "Memory Error"

} catch {

Write-Warning "Error moving user"

Get_Reports $user "Error_Users"

} finally {

## Generate report after user changes have been applied

Get-QADUser $user.Name | % {Get_Reports $_ "Post-Cleanup_Users"}

} # end finally

} # end else

} # end function Process_Users

## Function to create pop-up message(s) with information about the script and initiate the rest of the functions if the user chooses to do so.

function Notifications {

$script_description = "This script will go through Active Directory and match ... {script description}.

Do you wish to proceed?"

$a = New-Object -ComObject wscript.shell

$proceed = $a.popup($script_description,0,"Script Description",4)

if ($proceed -eq 6) {

## Answered "Yes", proceed with script

Write-Host "YES"

Write-Host "Processing Contacts and Users"

## Process users

Get-QADObject @contact_splat | %{Get_Reports $_ "Contacts"} | % {Process_Users $_}

Invoke-Item $report_path

} # end if

else {

## Answered "NO" exit script.

Write-Host "*** Exiting Script ***"

} # end else

} # end function Notifications

## Run the notification and give the user an option to terminate program before executing.

Notifications

Exporting User Objects to a CSV file ready for importing again?

Swatto — Tue, 19 Mar 2013 21:21:48 GMT

Hi All,

I am extremely new to powershell but I am working on a script to export user objects from AD - effectively taking a backup of them and then I would like to be able to restore them using csvde or something from the CSV. The trouble is the export-csv puts all stuff about activeroles server etc in it and my csvde command does not work when importing the CSV file. Please can you provide assistance as to why this occurs? I can only think the Export-CSV command is doing something 'clever' with the user object.

My Code:

Add-PSSnapin quest.activeroles.admanagement | Out-Null
Connect-QADService | Out-Null

$Users = Get-QADUser -SearchRoot 'OU=SwattosUsers,DC=swatto,DC=home' -Sizelimit 0
foreach ($User in $Users)
{
$Username = $User.sAMAccountName
$Date = Get-Date -f dd.MM.yy_hh.mm.ss
[string]$Foldername = "$Username.$Date"
New-Item -Path c:\ArchivedUsers -ItemType Directory -Name $Foldername | Out-Null
$User | export-CSV "c:\ArchivedUsers\$Foldername\$Username.csv" -NoTypeInformation
}
Read-Host

Thanks for any help you can provide

Exporting ouput

rishi.vohra — Tue, 19 Mar 2013 15:58:30 GMT

Dear All,

I have this script which gathers inactive computer objects since last 90 days

How can I extact this on to a csv file? Not sure what other code will be added

here's my script-

----------------------------

# SCRIPT INFORMATION

# NAME          : InactiveComputerObjects.ps1
# VERSION       : 1.0
# DESCRIPTION         : Finds all computer objects in Active Directory that have not been used since X                                  number of days
# Complany              : HCL
# Last Modified         :       03/13/2013
# Last Modified by      :       Rishi Vohra (rishiv@hcl.com)

function FindComputers( [int]$AgeThreshold, [string]$SearchBase )
{
    ImportModule "activedirectory"
    $CurrentTimeZone = GetCurrentTimeZone $true
    $DateNow = Get-Date #Time and date in local timezone
    $DateNowUtc = [System.DateTime]::UtcNow #Convert to UTC time
    $DateFilter = $DateNowUtc.AddDays(-$AgeThreshold) #Subtract specified days
    $DateFilterFileTime = $DateFilter.ToFileTime() # Generate the filter date in Windows ticks since 12:00 midnight January 1, 1601 C.E. UTC.
    Output "Current time is $DateNow $CurrentTimeZone."
    Output "Current UTC time is $DateNowUtc. This is the base for all further calculations against Active Directory."
    Output "$AgeThreshold days has been set as threshold for the criteria ($DateNowUtc - $AgeThreshold = $DateFilter)."
    Output "Computer objects with attribute `"lastLogonTimestamp`" greater than or equal to $DateFilter will meet criteria."

    # Build LDAP filter
    $LdapFilter = "(lastLogonTimestamp<=$DateFilterFileTime)"

    # Build SearchBase
    If ($SearchBase -eq "")
    {
        $SearchBase = GetDefaultNamingContext
    }

    Output "Active Directory connection details:`n `t Search filter = $LdapFilter `n `t SearchBase = $SearchBase"
    Output "Performing query..."

    # Query Active Directory for objects that meets date criteria
    $Computers = Get-ADComputer -LDAPFilter $LdapFilter -SearchBase $SearchBase -Properties lastLogonTimestamp
    if ($Computers -is [object])
    {
        foreach ($computer in $Computers)
        {
            # Handle each computer object that meets criteria
            $ComputerDate = [System.DateTime]::FromFileTimeUtc($computer.lastLogonTimestamp) #Convert data to human readable format, UTC time.
            Output "$computer, $ComputerDate"
        }
    }
    else
    {
        Output "No matching records found."
    }
}

Function ImportModule([string]$ModuleName)
{
    # Imports a module if it is not loaded in the current session
    # Usage:
    #     ImportModule "<modulename>"
    # Example:
    #     ImportModule "activedirectory"
    #

    [bool]$ModuleIsLoaded = $False
    $LoadedModules = Get-Module | Select Name
    If ($LoadedModules -is [object])
    {
        #One or more modules are loaded
        ForEach ($Module in $LoadedModules)
        {
            $ModuleLower = $Module.Name.ToLower()
            If ($ModuleLower -eq $ModuleName)
            {
                #The module we are searching for is already imported. Create flag.
                $ModuleIsLoaded = $True
            }
        }
        If ($ModuleIsLoaded -eq $False)
        {
            #Some modules currently imported but not $ModuleName. Let's import it.
            Import-Module $ModuleName
        }
    }
    else
    {
        #No modules currently imported. Let's import it.
        Import-Module $ModuleName
    }
}

Function GetDefaultNamingContext()
{
    # Returns the Default Naming Context in the current domain as System.DirectoryServices.PropertyValueCollection.
    # Example of a Default Naming Context: "DC=bekaertcorp, DC=Local"
    #
    $dirEntry = [System.DirectoryServices.DirectoryEntry]("LDAP://RootDSE")
    $dnc = $dirEntry.defaultNamingContext
    return $dnc
}

Function GetCurrentTimeZone([bool]$ShortenDisplayName)
{
    # Returns the DisplayName or short DisplayName of current timezone as string.
    # Example of a DisplayName: (UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna
    # Example of a short DisplayName: (UTC+01:00)
    #
    # Input: $TRUE or $FALSE
    # $TRUE returns a shortened DisplayName while $FALSE returns the full DisplayName
    $TimeZone = [System.TimeZoneInfo]::Local
    $TimeZoneName = $TimeZone.DisplayName
    $TimeZoneShortName = $TimeZoneName.Substring(0,$TimeZoneName.IndexOf(")")+1)
    If ($ShortenDisplayName -eq $FALSE)
    {
        Return $TimeZoneName
    }
    else
    {
        Return $TimeZoneShortName
    }
}

Function Output([string]$textline)
{
    Write-Host $textline
}

# Script configuration
# Fill in the details below.
#--------------------------
[int]$NumberOfDays = 90
[string]$SearchRoot = ""

FindComputers $NumberOfDays $SearchRoot #Start script

Need IP address and Mac address and Names of all printers connected to domain

rishi.vohra — Tue, 19 Mar 2013 13:43:36 GMT

Dear all,

I am trying to get a script which can fetch Names + IP + Mac addess of all the printers connected to Domain

we have 1600 Printers and 80 sites

I have got hold of few but I need to do the modification everytime and change the servername

Is there any possbile solution?

I am very new to scripting and very much interested in keeping this handy

This comes as a gentle request

An ADSI interface and Method question.

EBrant — Wed, 20 Mar 2013 13:20:23 GMT

Hello All

Hello

Can someone please help me with the following question? In some respects it is a little unusual and quirky. I understand what went wrong and how to fix it, but there is an element I am a bit unclear on (the interesting bit), I have a hunch but not certain, help most appreciated.

I am dealing with Microsoft Active Directory and the [ADSI] DirectoryServices.DirectoryEntry and [ADSISEARCHER] DirectoryServices.DirectorySearcher interfaces to AD.

Now let’s say I have

AD Domain called MyDomain.net

Three OU’s called under MyDoamin (Windows 2003 R2)

OU1
OU2
Groups

Under OU1 there are two users
User1
User2

Under OU2 there are two users
User3
User4

Under the Groups OU there are two three groups
Group1
Group2
Group3

Now let’s say the following users are members of the following groups

Group1 members
User1 under OU1
User2 under OU1
User3 under OU2

Therefore the key here is that User3 under OU2 is a member of Group1 alongside Users1 and 2 from OU1

Now I want to remove any users from Group1 “as long as the user is under OU1 and no other OU”, therefore the result should be that Group1 ends up with just User3.

I realise I can do this with the Quest AD cmdlets, but I want to focus on how I initially did it using [ADSI] why it went wrong and how I resolved it, and therein my question (coming later).

So my initial code was

$OU = "LDAP://OU=OU1,DC=MyDomain,DC=net"

$ObjectType="(&(objectCategory=Person)(objectClass=User))"

$Searcher = [DirectoryServices.DirectorySearcher]""

$Searcher.SearchRoot=$OU

$Searcher.Filter=$ObjectType

$Users = $Searcher.FindAll()

foreach ($user in $Users) {

$GroupNames = ($user.PSBase.Properties.memberof | where {$_ -match "CN=Group1"})

foreach ($GroupName in $GroupNames) {

if ($user.PSBase.Properties.memberof | where {$_ -match "CN=Group1"})

{

$GroupObj=[ADSI]"LDAP://$GroupName"

$GroupObj.Remove("LDAP://$user")

}

First off, if you look at the result of $Users

It returns only the users accounts under OU1 as designed, i.e. it returns a collection of object of type System.DirectoryServices.SearchResult which I know are cut down objects and if you want the actual object you need to use the GetDirectoryEntry() method, but I will come to this later.

If I run the above script the result will be that all users (including User3 under OU2) will be removed from the group, and not just the collection of users I am working on in the foreach loop i.e. foreach ($user in $Users) as we know $Users only contains search results from users under OU1, so I am thinking why did it process a user (user3) under OU2 when it was not even in the collection of $Users.

So I am thinking perhaps the following line

$GroupObj.Remove("LDAP://$user")

i.e. the $User part is acting on the Class ‘user’ rather than the particular instance of the class e.g. the user in question under OU1 which is why it removed all users. However I do not see why as the LDAP://$user should pick out and attach to a particular instance as each instance of $user represents a specific user in my collection

So then I take a closer look at $user it returns the following to the console

Path
----

LDAP://CN=User1,OU=OU1,DC=mydomain,DC=net

Properties
----------
{blah blah }

Path
----

LDAP://CN=User2,OU=OU1,DC=mydomain,DC=net

Properties
----------
{blah blah }

That looks OK, again no mention at all of User3

So then I do the following

$OU = "LDAP://OU=Users,OU=OU1,DC=MyDomain,DC=net"

$ObjectType="(&(objectCategory=Person)(objectClass=User))"

$Searcher = [DirectoryServices.DirectorySearcher]""

$Searcher.SearchRoot=$OU

$Searcher.Filter=$ObjectType

$Users = $Searcher.FindAll()

foreach ($user in $Users) {

$GroupNames = ($user.PSBase.Properties.memberof | where {$_ -match "CN=Group1"})

foreach ($GroupName in $GroupNames) {

if ($user.PSBase.Properties.memberof | where {$_ -match "CN=Group1"})

{

$UserObj = $user | % {$_.GetDirectoryEntry()} | % {$_.distinguishedName

}

$GroupObj=[ADSI]"LDAP://$GroupName"

$GroupObj.Remove("LDAP://$UserObj")

}

This time the script works as expected and only removes Users under OU1 (User1 and User1) from Group1 and not users under OU2 (User3).

I realise with the second example I am getting the actual user object (as opposed to a cut down searcher result) from AD with the GetDirectoryEntry() method, but I did not think this was necessary; as event before invoking the GetDirectoryEntry() method each $user only represents one user and always under OU1 (event if is only a System.DirectoryServices.SearchResult object)

Perhaps without using GetDirectoryEntry() the following might work

$GroupObj.Remove("$($User.path)")

Not tested that one yet.

Any advice on the mechanics of the above and how/why in the first example all users are remove from the group would be most welcome.

Thanks

Ernie