1

We have a simple script to update user attributes in Active Directory from a CSV file. I want to develop the script a little further to include simple error handling. Basically, I would like to know which users attributes were successfully updated and which attributes were not. We’re looking into updating 5000+ user attributes so we will need a simple way of going back to see what attributes did not get updated. The script is below…what’s the simplest way to log anything that does not get updated successfully out of these Active Directory attributes?

Import-module ActiveDirectory
Import-CSV C:\Users\testuser\Desktop\test.csv | % {
$mail = $_.mail
$ID = $_.EmployeeID
$City = $_.City
$Country = $_.Country
$Company = $_.Company
$Department = $_.Department
$Description = $_.Description
$Division = $_.Division
$GivenName = $_.GivenName
$Manager = $_.Manager
$Mobile = $_.Mobile
$PostalCode = $_.PostalCode
$State = $_.State
$StreetAddress = $_.StreetAddress
$Title = $_.Title
$Office = $_.Office
$user = Get-ADUser -Filter {mail -eq $mail}
Set-ADUser $User.samaccountname -employeeID $ID -City $City -Country $Country -Company $Company -Department $Department -Description $Description -Division $Division -GivenName $GivenName -Manager $Manager -Mobile $Mobile -PostalCode $PostalCode -State $State -StreetAddress $StreetAddress -Title $Title -Office $Office
}
6 Spice ups
2

like so?

try{
    Set-ADUser $User.samaccountname <#stuff#> -ErrorAction Stop
}
catch{
    write-output"Error setting value for '$($User.samaccountname)'" |
    out-file "c:\error.log" -Append
}
1 Spice up
3

I assume you mean which users don’t get updated, not which attribute is not updated. Most likely, Powershell updates the users using ADSI functions which set all of the attributes on the entire directory object at once, but these functions are an all-or-nothing function: if anything goes wrong, the directory object isn’t updated at all. There isn’t any way to know which attribute was causing the problem or why.

4

He could check each parameter and check if it was set, but that sounds like a pain in the rear end :¬)

1 Spice up
5

But that won’t work, when Set-AdUser fails, nothing will get updated. I just tested to see by updating the employeeID and another value, and I set a really long employeeID to force an error. I was impressed by the error indicating that one of the attributes was out of the range (length), but the other attribute was not updated. This is to be expected as its how AD works internally. When Hyena is used to update multiple attributes, we have the same problem: there isn’t any way of knowing which attribute/value is causing the issue.

6

I am not able to understand here you have all the attributes set in CSV but not the user? but you are calling users from

$user = Get-ADUser -Filter {mail -eq $mail}

^^ this command, is it going to match with the details?

you need to add username in the csv for whom you are setting the attributes and also you can use splatting.

Import-CSV C:\Users\testuser\Desktop\test.csv | ForEach{
$splat = @{
'Samaccountname'=$_.username
'mail' = $_.mail
'EmployeeID' = $_.EmployeeID
'City'= $_.City
'Country' = $_.Country
'Company' = $_.Company
'Department' = $_.Department
'Description' = $_.Description
'Division' = $_.Division
'GivenName' = $_.GivenName
'Manager' = $_.Manager
'Mobile' = $_.Mobile
'PostalCode' = $_.PostalCode
'State' = $_.State
'StreetAddress' = $_.StreetAddress
'Title' = $_.Title
'Office' = $_.Office
}
}
Set-ADUser @Splat
1 Spice up
7

This would be something worth creating an advanced function for. May take a little longer but you will get so much more out of it and have a reusable tool that can be shared.

Definitely use a try catch finally block, parameter sets, and splatting . You’ll be happier with the results I promise.

8

handle errors

$ErrorActionPreference='stop'
Import-CSV C:\Users\testuser\Desktop\test.csv | ForEach{
$splat = @{
'Samaccountname'=$_.username
'mail' = $_.mail
'EmployeeID' = $_.EmployeeID
'City'= $_.City
'Country' = $_.Country
'Company' = $_.Company
'Department' = $_.Department
'Description' = $_.Description
'Division' = $_.Division
'GivenName' = $_.GivenName
'Manager' = $_.Manager
'Mobile' = $_.Mobile
'PostalCode' = $_.PostalCode
'State' = $_.State
'StreetAddress' = $_.StreetAddress
'Title' = $_.Title
'Office' = $_.Office
}
}
Try{
Set-ADUser @Splat
}
Catch{
Write-Warning " $error[0] "
write-output $_ |out-file c:\errors.txt
}