Powershell – set-aduser inside foreach loop

powershell

I'm trying to get the below script to change three things on an AD account. I want it to expire the account, change an attribute, and append disabled account to the current description. It does everything except append the description. As it stands the script just replaces the description field with Disabled Account instead of append it to what is already there.

$Yesterday = (Get-Date).AddDays(-1)
$DisableUserList = Get-Content C:\Myscripts\test.csv
$DisableUsers = foreach ($user in $DisableUserList) { get-aduser -filter { mail -eq $user } }


ForEach ($user in $DisableUsers) {
        Set-ADUser $user -Description "Disabled Account $($_.Description)" -AccountExpirationDate $Yesterday -replace @{ businesscategory = "21" }
}

The .csv file only has one column of email addresses.

Any help is appreciated.

Thank you

Best Answer

Your problem is that the $($_.Description) part of your Set-ADUser command is empty. The reason is that Get-ADUser doesn't retrieve the account's description by default. You need to explicitly ask for it in your command like this:

get-aduser -filter { mail -eq $user } -Properties Description

Your other problem is that you're not referencing your disabled user properly within your final loop. You're currently using ForEach ($user in $DisabledUsers) which means to access properties on each user they need to be prefixed with $user.MyProperty instead of $_.MyProperty. If you want to use the $_ notation, you need to change the style of your for loop to this:

$DisabledUsers | ForEach-Object {

You can also shorten that to just:

$DisabledUsers | % {

Finally, you say you want to append (add to the end) your text to the current description, but your code is currently trying to prepend (add to the beginning). Assuming you do actually want to append, you'd need to change your description string definition to this:

-Description "$($_.Description) Disabled Account"

Related Solutions

Powershell script for setting password expiry

A better fix would be to set those 100 accounts to be required to change password on next login (thus not preventing them from logging in), and then a few days later, setting a password age policy (or fine-grained password policies, if you need more than one.)

The first step could be done pretty easily with a CSV input for dsquery, piped into dsmod; keeps it very simple.

The second step will prevent the helpdesk from making this mistake in the future, by taking that part of the process out of their hands.

Powershell – (Powershell) Method to return a list of groups where a specific user has ‘write member’ security

There are two problems here.

The CMDlet Get-QADPermission is writing directly to the console during execution which is why you're seeing Permissions for: .... Since your pipeline is writing to the same output, it all gets mixed together. Store the output from your pipeline to a variable instead.
When you pipe the group into Get-QADPermission, you're throwing away the group object and getting a permissions object instead. If you want to keep the original object, you need to filter with Where-Object.

Also, be careful with Get-QADPermission. If you only query for WriteProperty, it won't return results with both Read+Write access. Usually you want to query for both. And in most cases, you also want to use -Inherited to get permissions granted from parent OU's. If you're really looking for once-off permissions, then you can ignore this switch.

function Test-UserCanModifyGroupsInOU ($Username, $OU)
{
  $results = Get-QADGroup -SearchScope 'OneLevel' -SearchRoot $OU |
    Where-Object {
      $_ | Get-QADPermission -Rights ReadProperty,WriteProperty -Property member -Account $username
    } |
    Select @{Name="User";Expression={$username}}, @{Name="Group";Expression={$_.Name}}
  $results | Write-Output
  $results | Export-Csv "$username.csv"
}

@("bob","sally") |
  ForEach-Object {
    Test-UserCanModifyGroupsInOU -Username $_ -OU 'domain.org.com/path/to/OU'
  }

Also note that this only works for permissions on specific properties. It won't return results for a user that has "Full Control" on the group, even though they're stil allowed to modify the member attribute.

Best Answer

Related Solutions

Powershell script for setting password expiry

Powershell – (Powershell) Method to return a list of groups where a specific user has ‘write member’ security

Related Topic