Hey everyone.
I've been using a powershell script I pieced together to dump systems from AD and determine if they are 'stale'.
This script has worked perfectly fine for a few years, but not I'm running into the 'invalid enumeration context' error with get-adcomputer.
My script is now taking over 30 minutes to run and thus producing the above error.
Here is the code:
$d = (Get-Date).AddDays(-90)
$default_log = $env:userprofile + '\Documents\AD_Computer_Report.csv'
Foreach($domain in (get-adforest).domains){
Get-ADComputer -Filter {(isCriticalSystemObject -eq $False)} -Properties UserAccountControl,`
PwdLastSet,WhenChanged,samAccountName,Name,LastLogonTimeStamp,Enabled,admincount,IPv4Address,`
operatingsystem,operatingsystemversion,serviceprincipalname,description -server $domain |
select @{name='Domain';expression={$domain}}, `
Name,operatingsystem,operatingsystemversion,Enabled,IPv4Address, `
@{Name="Stale";Expression={if((($_.pwdLastSet -lt $d.ToFileTimeUTC()) -and ($_.pwdLastSet -ne 0)`
-and ($_.LastLogonTimeStamp -lt $d.ToFileTimeUTC()) -and ($_.LastLogonTimeStamp -ne 0)`
-and ($_.admincount -ne 1) -and ($_.IPv4Address -eq $null)) -and `
(!($_.serviceprincipalname -like "*MSClusterVirtualServer*"))){$True}else{$False}}}, `
@{Name="ParentOU";Expression={$_.distinguishedname.Substring($_.samAccountName.Length + 3)}},description `
| export-csv $default_log -append -NoTypeInformation}
I'm trying to build a new script that uses adsisearcher instead, but I'm not able to figure out how to pull the IP address, enabled status, or parent OU.
Here is that script:
$default_log = $env:userprofile + '\Documents\Updated_AD_Comp_Report.csv'
$searcher = ([adsisearcher]"(&(objectclass=computer))")
$searcher.PageSize = 200
#$searcher.SizeLimit = "5"
$searcher.PropertiesToLoad.AddRange(('UserAccountControl','PwdLastSet','WhenChanged','samAccountName','Name','LastLogonTimeStamp','Enabled','admincount','IPv4Address','operatingsystem','operatingsystemversion','serviceprincipalname','description'))
$output =
Foreach ($ComputerAccount in $searcher.FindAll()){
New-Object -TypeName PSObject -Property @{
UserAccountControl = $ComputerAccount.properties.useraccountcontrol -as [string]
PwdLastSet = $ComputerAccount.properties.pwdlastset -as [string]
WhenChanged = $ComputerAccount.properties.whenchanged -as [string]
samAccountName = $ComputerAccount.properties.samaccountname -as [string]
Name = $ComputerAccount.properties.name -as [string]
LastLogonTimeStamp = $ComputerAccount.properties.lastlogontimestamp -as [string]
Enabled = $ComputerAccount.properties.enabled -as [string]
admincount = $ComputerAccount.properties.admincount -as [string]
IPv4Address = $ComputerAccount.properties.IPv4Address -as [string]
operatingsystem = $ComputerAccount.properties.operatingsystem -as [string]
operatingsystemversion = $ComputerAccount.properties.operatingsystemversion -as [string]
serviceprincipalname = $ComputerAccount.properties.serviceprincipalname -as [string]
description = $ComputerAccount.properties.description -as [string]
}
}
$output | export-csv $default_log -append -NoTypeInformation
Ideally I would be able to get my original script working using get-adcomputer, but I'm open to any recommendations.
Thanks for any help!