Powershell – Delete Computer Object in AD with Powershell

OK, so I've been tinkering with this one for a bit and got it working. At first, it looked like the script was running as expected, except that it would show an error message in the console whenever the reg query command didn't find the reg key that it was looking for. That in itself was not an issue, but after that I would have expected it to continue and run the if code block - instead it seemed to be skipping right on to processing the next object in the foreach-object queue from the pipeline. I am not sure what was going on there, but eventually I got the code to the point where it was evaluating everything correctly and trying to run the if code block. This time, I was getting the following error whenever the script hit an Out-Host statement: Out-Host : A positional parameter cannot be found that accepts argument mystringvar. Apparently there is something about using Out-Host that causes ForEach-Object to think that the processing code block is done. Anyway, I overcame this by switching to using Write-Output instead. Here's the final working code:

import-module bsonposh
add-pssnapin Quest.ActiveRoles.ADManagement

get-qadcomputer -sizelimit 0 -searchroot 'OU=MyComputers,DC=MyDomain,DC=lcl' | test-host -property name |ForEach-Object -process {
    $targnm = $_.name
    $tststr=(reg query "\\$targnm\HKLM\SOFTWARE\JavaSoft\Java Runtime Environment" /v Java6FamilyVersion)
    if(-not($tststr |select-string -simplematch '1.6.0_20'))
    {
        $mssg="Updating to JRE 6u20 on $targnm"
        Write-Output $mssg
        Out-File -filepath c:\install_jre_log.txt -inputobject $mssg -Append
        cmd /c \\myfileserver\apps\java\installjreremote.cmd $targnm
    }
    else
    {
        $mssg ="JRE 6u20 found on $targnm"
        Write-Output $mssg
        Out-File -filepath c:\install_jre_log.txt -inputobject $mssg -Append
    }
}

As far as I know, there is no way to pass alternate credentials using the ADSI type accelerator. Two ways you could try to get around this in your code are:

• have powershell.exe run as the domain user instead of your local user - this will cause everything in the script to use the domain credentials
• use the Invoke-Command cmdlet, which allows you to pass in a script block to execute, and alternate credentials.

I've never tried either of these, so it will take some trial and error.

Another option that could be more flexible for you is to not use the ADSI type accelerator. There are 2 ways to accomplish this.

1. Use the .NET framework DirectoryService classes. Here is a good article that walks you through this process. It includes an example using alternate credentials.
2. Use the Quest Active Directory Management cmdlets. These are wrappers around a lot of AD stuff that make a lot of things easier. They also let you pass in alternate credentials.