{"id":16831,"date":"2010-10-13T00:01:00","date_gmt":"2010-10-13T00:01:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2010\/10\/13\/use-powershell-to-search-active-directory-users-missing-values-and-add-same\/"},"modified":"2010-10-13T00:01:00","modified_gmt":"2010-10-13T00:01:00","slug":"use-powershell-to-search-active-directory-users-missing-values-and-add-same","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/use-powershell-to-search-active-directory-users-missing-values-and-add-same\/","title":{"rendered":"Use PowerShell to Search Active Directory Users’ Missing Values and Add Same"},"content":{"rendered":"

 <\/p>\n

Summary<\/strong>: Learn how to use Windows PowerShell to search Microsoft Active Directory for users that have missing values, and automatically add default values.<\/p>\n

 <\/p>\n

\"Hey,<\/p>\n

Hey, Scripting Guy! We have several network administrators where I work. Unfortunately, all of them have complete rights to Active Directory. This means that any one of the administrators can create a user. We have scripts that we are supposed to use when creating a user, but from time to time, one of the administrators will use Active Directory Users and Computers to manually create the user. When this happens, invariably something gets messed up. <\/p>\n

We just had an audit, and we got hit on the inspection due to the fact that our users are created in an inconsistent manner. We have 30 days to resolve our deficiencies before “stuff” hits the fan. What I need is a Windows PowerShell script that will search a particular Active Directory organizational unit for users that are missing a value for a specific attribute. After a user has been identified, I need the script to add a value for that attribute. Do you have a script that can perform this task for us?<\/p>\n

— CW<\/p>\n

 <\/p>\n

\"Hey,<\/p>\n

Hello CW, <\/p>\n

Microsoft Scripting Guy Ed Wilson here. I keep waiting for things to slow down. It seems like it does not matter how many meetings one goes to, or how many emails one answers. There are always more coming down the pike. It is like “honey do” lists at home or lists of scripts I want to write. I have a whiteboard in my office that contains a list of scripts I want to write someday. It seemed like a good idea at the time. The scripts are all things that will take a bit of research to write. The problem is that script ideas come to the board faster than I can erase completed scripts to make room for more scripts. Scribbles cover the board; I may add a second board. <\/p>\n

CW, you are in luck because one of my whiteboard hieroglyphics represents the exact script scenario you detailed in your email to scripter@microsoft.com<\/a>. Actually, we are both in luck because I get to erase said hieroglyph from the board. The complete FindAndAddEmptyADValues.ps1 Windows PowerShell script is shown here.<\/p>\n

\n

FindAndAddEmptyADValues.ps1<\/strong><\/span><\/span><\/p>\n

Function<\/span> <\/span>Get-UsersFromOU<\/span>
<\/span>{<\/span>
 <\/span>Param(<\/span>
  <\/span>$SearchRoot<\/span>,<\/span>
  <\/span>$filter<\/span> <\/span>=<\/span> “ObjectCategory=Person”
 <\/span>)<\/span>
 <\/span>$ds<\/span> <\/span>=<\/span> <\/span>[adsiSearcher]<\/span>$filter<\/span>
 <\/span>$ds<\/span>.SearchRoot<\/span> <\/span>=<\/span> <\/span>[adsi]<\/span>“LDAP:\/\/$SearchRoot”
 <\/span>$ds<\/span>.findAll()<\/span> 
<\/span>}<\/span> <\/span>#<\/span>end<\/span> <\/span>get-usersFromOu<\/span>
<\/span>Function<\/span> <\/span>Set-AttributeValue<\/span>
<\/span>{<\/span>
 <\/span>Param(<\/span>
 <\/span>$SR<\/span>,<\/span>
 <\/span>$SearchAttribute<\/span>,<\/span>
 <\/span>$NewValue<\/span>
 <\/span>)<\/span>
 <\/span>$i<\/span> <\/span>=<\/span> <\/span>$null<\/span>
  <\/span>Foreach<\/span>(<\/span>$user<\/span> <\/span>in<\/span> <\/span>$sr<\/span>)<\/span> <\/span>{<\/span>
  <\/span>IF<\/span>([string]::isNullOrEmpty(<\/span>$user<\/span>.properties.item(<\/span>$SearchAttribute<\/span>)))<\/span>
   <\/span>{<\/span>
     <\/span>$de<\/span> <\/span>=<\/span> <\/span>$user<\/span>.GetDirectoryEntry()<\/span>
     “modifying $($de.name)”
     <\/span>$de<\/span>.<\/span>$SearchAttribute<\/span> <\/span>=<\/span> <\/span>$newValue<\/span>
     <\/span>$de<\/span>.setinfo()<\/span>
     <\/span>$i++<\/span>
   <\/span>}<\/span> <\/span>#<\/span>end<\/span> <\/span>if<\/span>
  <\/span>}<\/span> <\/span>#<\/span>end<\/span> <\/span>foreach-object<\/span>
  “modified $i users”
<\/span>}<\/span> <\/span>#<\/span> <\/span>end<\/span> <\/span>Set-AttributeValue<\/span> <\/p>\n

<\/span>#<\/span> <\/span>***<\/span> <\/span>Entry<\/span> <\/span>Point<\/span> <\/span>to<\/span> <\/span>script<\/span> <\/span>***<\/span> <\/p>\n

<\/span>$sr<\/span> <\/span>=<\/span> <\/span>Get-UsersFromOU<\/span> <\/span>-SearchRoot<\/span> “ou=testou,dc=nwtraders,dc=com”
<\/span>Set-AttributeValue<\/span> <\/span>-SR<\/span> <\/span>$sr<\/span> <\/span>-SearchAttribute<\/span> “description” <\/span>-NewValue<\/span> “By Script”<\/span> <\/div>\n<\/blockquote>\n

The FindAndAddEmptyADValues.ps1 begins with the Get-UsersFromOU<\/strong> function. The function accepts two parameters: the first parameter specifies the organizational unit (OU) to use for the search root, and the second parameter specifies the search filter. The search filter is set to filter out objects that are equal to the objectcategory<\/strong> of person. A filter such as this one will exclude computer objects. The parameter portion of the Get-UsersFromOU<\/strong> function is shown here: <\/p>\n

\n
Function<\/span> <\/span>Get-UsersFromOU<\/span>
<\/span>{<\/span>
 <\/span>Param(<\/span>
  <\/span>$SearchRoot<\/span>,<\/span>
  <\/span>$filter<\/span> <\/span>=<\/span> “ObjectCategory=Person”
 <\/span>)<\/span> <\/div>\n<\/blockquote>\n

The [adsiSearcher]<\/strong> type accelerator is used to create an instance of the System.DirectoryServices.DirectorySearcher<\/strong> .NET Framework class. The search filter is supplied to the [adsiSearcher]<\/strong> type accelerator for its constructor. Other ways of creating an instance of the DirectorySearcher<\/strong> class are documented on MSDN. The DirectorySearcher<\/strong> class is created here and stored in the $ds<\/strong> variable:<\/p>\n

\n
$ds<\/span> <\/span>=<\/span> <\/span>[adsiSearcher]<\/span>$filter<\/span> <\/div>\n<\/blockquote>\n

The searchRoot<\/strong> property of the DirectorySearcher<\/strong> needs to be an instance of a System.DirectoryServices.DirectoryEntry<\/a><\/strong> .NET Framework class. To easily create an instance of the DirectoryEntry<\/strong> class, use the [adsi]<\/strong> type accelerator as shown here: <\/p>\n

\n
$ds<\/span>.SearchRoot<\/span> <\/span>=<\/span> <\/span>[adsi]<\/span>“LDAP:\/\/$SearchRoot”<\/span> <\/div>\n<\/blockquote>\n

To find all of the objects that meet the search filter and are located in the search root, use the findall()<\/strong> method shown here:<\/p>\n

\n
$ds<\/span>.findAll()<\/span> <\/div>\n<\/blockquote>\n

The complete Get-UsersFromOU<\/strong> function is shown here.<\/p>\n

\n
Function<\/span> <\/span>Get-UsersFromOU<\/span>
<\/span>{<\/span>
 <\/span>Param(<\/span>
  <\/span>$SearchRoot<\/span>,<\/span>
  <\/span>$filter<\/span> <\/span>=<\/span> “ObjectCategory=Person”
 <\/span>)<\/span>
 <\/span>$ds<\/span> <\/span>=<\/span> <\/span>[adsiSearcher]<\/span>$filter<\/span>
 <\/span>$ds<\/span>.SearchRoot<\/span> <\/span>=<\/span> <\/span>[adsi]<\/span>“LDAP:\/\/$SearchRoot”
 <\/span>$ds<\/span>.findAll()<\/span> 
<\/span>}<\/span> <\/span>#<\/span>end<\/span> <\/span>get-UsersFromOU<\/span> <\/div>\n<\/blockquote>\n

The Set-AttributeValue<\/strong> function accepts three input parameters. The first is an instance of the System.DirectoryServices.SearchResultCollection<\/a> class that is returned from the Get-UsersFromOU<\/strong> function. The $searchAttribute<\/strong> parameter is the attribute that is to be checked for a value, and a value is supplied if it is empty or null. The $newValue<\/strong> parameter is the string value to add to the empty or null attribute value. This portion of the Set-AttributeValue<\/strong> function is shown here:<\/p>\n

\n
Function<\/span> <\/span>Set-AttributeValue<\/span> <\/p>\n

<\/span>{<\/span> <\/p>\n

 <\/span>Param(<\/span> <\/p>\n

 <\/span>$SR<\/span>,<\/span> <\/p>\n

 <\/span>$SearchAttribute<\/span>,<\/span> <\/p>\n

 <\/span>$NewValue<\/span> <\/p>\n

 <\/span>)<\/span>
<\/span><\/div>\n<\/blockquote>\n

The $i<\/strong> variable is used to count the number of users that are modified. It has its initial value set to $null<\/strong>. Because the $sr<\/strong> variable contains a SearchResultCollection<\/strong> class, I need to walk through the collection to retrieve an individual instance of the SearchResult<\/strong> class. The $user<\/strong> variable will contain a single instance of the SearchResult<\/strong> class on each pass through the collection. The isNullOrEmpty<\/strong> static method is used from the system.string<\/strong> .NET Framework class. This portion of the function is shown here:<\/p>\n

\n
$i<\/span> <\/span>=<\/span> <\/span>$null<\/span> <\/p>\n

  <\/span>Foreach<\/span>(<\/span>$user<\/span> <\/span>in<\/span> <\/span>$sr<\/span>)<\/span> <\/span>{<\/span> <\/p>\n

  <\/span>IF<\/span>([string]::isNullOrEmpty(<\/span>$user<\/span>.properties.item(<\/span>$SearchAttribute<\/span>)))<\/span>
<\/span><\/div>\n<\/blockquote>\n

The SearchResult<\/strong> class has a GetDirectoryEntry<\/strong> method that will create a DirectoryEntry<\/strong> class that matches the SearchResult<\/strong>. The attribute receives a new value, and the setinfo()<\/strong> method is called to write the changes back to Active Directory. The value of the $i<\/strong> counter variable is then incremented, and a summary string is displayed in the Windows PowerShell console. This portion of the function is shown here:<\/p>\n

\n
{<\/span> <\/p>\n

     <\/span>$de<\/span> <\/span>=<\/span> <\/span>$user<\/span>.GetDirectoryEntry()<\/span> <\/p>\n

     “modifying $($de.name)” <\/p>\n

     <\/span>$de<\/span>.<\/span>$SearchAttribute<\/span> <\/span>=<\/span> <\/span>$newValue<\/span> <\/p>\n

     <\/span>$de<\/span>.setinfo()<\/span> <\/p>\n

     <\/span>$i++<\/span> <\/p>\n

   <\/span>}<\/span> <\/span>#<\/span>end<\/span> <\/span>if<\/span> <\/p>\n

  <\/span>}<\/span> <\/span>#<\/span>end<\/span> <\/span>foreach-object<\/span> <\/p>\n

  “modified $i users” <\/p>\n

<\/span>}<\/span> <\/span>#<\/span> <\/span>end<\/span> <\/span>Set-AttributeValue<\/span>
<\/span><\/div>\n<\/blockquote>\n

The complete Set-AttributeValue<\/strong> function is shown here.<\/p>\n

\n
Function<\/span> <\/span>Set-AttributeValue<\/span> <\/p>\n

<\/span>{<\/span> <\/p>\n

 <\/span>Param(<\/span> <\/p>\n

 <\/span>$SR,<\/span> <\/p>\n

 <\/span>$SearchAttribute,<\/span> <\/p>\n

 <\/span>$NewValue<\/span> <\/p>\n

 <\/span>)<\/span> <\/p>\n

 <\/span>$i<\/span> <\/span>=<\/span> <\/span>$<\/span>null<\/span> <\/p>\n

  <\/span>Foreach($user<\/span> <\/span>in<\/span> <\/span>$sr)<\/span> <\/span>{<\/span> <\/p>\n

  <\/span>IF([<\/span>string<\/span>]::isNullOrEmpty($user.properties.item($SearchAttribute)))<\/span> <\/p>\n

   <\/span>{<\/span> <\/p>\n

     <\/span>$de<\/span> <\/span>=<\/span> <\/span>$user.GetDirectoryEntry()<\/span> <\/p>\n

     “modifying $($de.name)” <\/p>\n

     <\/span>$de.$SearchAttribute<\/span> <\/span>=<\/span> <\/span>$newValue<\/span> <\/p>\n

     <\/span>$de.setinfo()<\/span> <\/p>\n

     <\/span>$i++<\/span> <\/p>\n

   <\/span>}<\/span> <\/span>#<\/span>end<\/span> <\/span>if<\/span> <\/p>\n

  <\/span>}<\/span> <\/span>#<\/span>end<\/span> <\/span>foreach<\/span>–<\/span>object<\/span> <\/p>\n

  “modified $i users” <\/p>\n

<\/span>}<\/span> <\/span>#<\/span> <\/span>end<\/span> <\/span>Set-AttributeValue<\/span>
<\/span><\/div>\n<\/blockquote>\n

The entry point to the FindAndAddEmptyAdValues.ps1 script calls the Get-UsersFromOU<\/strong> function and stores the returned SearchResultCollection<\/strong> in the $sr<\/strong> variable. It then calls the Set-AttributeValue<\/strong> function and passes the SearchResultCollection<\/strong>, an attribute to search, and a new value to supply if the attribute value is empty or null. This portion of the script is shown here:<\/p>\n

\n
#<\/span> <\/span>***<\/span> <\/span>Entry<\/span> <\/span>Point<\/span> <\/span>to<\/span> <\/span>script<\/span> <\/span>***<\/span> <\/p>\n

  <\/p>\n

<\/span>$sr<\/span> <\/span>=<\/span> <\/span>Get-UsersFromOU<\/span> <\/span>-SearchRoot<\/span> “ou=testou,dc=nwtraders,dc=com” <\/p>\n

<\/span>Set-AttributeValue<\/span> <\/span>-SR<\/span> <\/span>$sr<\/span> <\/span>-SearchAttribute<\/span> “description” <\/span>-NewValue<\/span> “By Script”
<\/span><\/div>\n<\/blockquote>\n

When I ran the script on my computer, the output shown in the following image appeared in my Windows PowerShell ISE.<\/p>\n

\"Image<\/a><\/p>\n

 <\/p>\n

CW, that is all there is to using Windows PowerShell to search AD DS for users with empty attribute values and then add values to those attributes. Active Directory Week will continue tomorrow when we will talk about using the Microsoft Active Directory cmdlets<\/a> to search AD DS for users with empty attribute values. <\/p>\n

We invite you to follow us on Twitter<\/a> and Facebook<\/a>. If you have any questions, send email to us at scripter@microsoft.com<\/a>, or post your questions on the Official Scripting Guys Forum<\/a>. See you tomorrow. Until then, peace.<\/p>\n

 <\/p>\n

Ed Wilson and Craig Liebendorfer, Scripting Guys<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"

  Summary: Learn how to use Windows PowerShell to search Microsoft Active Directory for users that have missing values, and automatically add default values.   Hey, Scripting Guy! We have several network administrators where I work. Unfortunately, all of them have complete rights to Active Directory. This means that any one of the administrators can […]<\/p>\n","protected":false},"author":595,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[7,3,8,20,45],"class_list":["post-16831","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-active-directory","tag-scripting-guy","tag-searching-active-directory","tag-user-accounts","tag-windows-powershell"],"acf":[],"blog_post_summary":"

  Summary: Learn how to use Windows PowerShell to search Microsoft Active Directory for users that have missing values, and automatically add default values.   Hey, Scripting Guy! We have several network administrators where I work. Unfortunately, all of them have complete rights to Active Directory. This means that any one of the administrators can […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/16831","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=16831"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/16831\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=16831"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=16831"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=16831"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}