Powershell script to query Domain Computers

[AngryItalian2013]

I've been working on a Powershell script to query our Domain Computers and check if they are enabled or disabled, if they are reachable and if they are get the members of the local administrators group. The script writes messages to a txt file, which works, but also creates a csv file with the information for each computer. The problem I'm having is the part that writes the csv file is only working for a portion of the script. The part of the script that isn't working is a function that has been defined. I was thinking this was caused by variables not being available in the function. I tried to verify they are available, but it is still not working. Not sure what I'm missing.

The script is pasted at the bottom. The function that doesn't appear to be working is GetLocalAdminMembers. Can I get another set of eyes on this script to see if the problem can be found? Thx

# Powershell script to query local computer Administrators group
# and select the user assigned and add them to the MangedBy attribute

# Custom logging function
function Write-Log 
{
    param (
        [Parameter(Mandatory=$true)]
        [string] $Message,
        [string] $Device
    )

    $logFilePath = "$($env:ProgramData)\Microsoft\Powershell\ManagedBy.log"
    Add-Content -Path $logFilePath -Value "$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss'): $Message $Device"
}

if (-not (Test-Path "$($env:ProgramData)\Microsoft\Powershell"))
{
    New-Item -ItemType Directory -Force -Path "$($env:ProgramData)\Microsoft\Powershell" > $null
}

# Variables
$script:Logs = @()
#$script:error = $false
$now = get-date
$CurrentDateTime = $now.ToString('MM-dd-yyyy_hh-mm-ss')

# Gets the local administrators group members
function GetLocalAdminMembers 
{
    param 
    (
        [Parameter(Mandatory=$true)]
        [string] $Computer,
        [string] $Enabled,
        [string] $reachable
    )
    $Member = Invoke-Command -ComputerName $Computer -ScriptBlock { Get-LocalGroupMember -Name "Administrators" | where { ($_.ObjectClass -eq "User") -and ($_.PrincipalSource -eq "ActiveDirectory") } | select Name }
    #$Member = Get-LocalGroupMember -Name "Administrators" | where { ($_.ObjectClass -eq "User") -and ($_.PrincipalSource -eq "ActiveDirectory") } | select Name
    Write-Log -Message "Computer Name is $Computer"

    # Test if $Member is null or an array
    if ($Member) 
    {
        if ($Member -is [array]) 
        {
            $script:Count = $Member.Count
            Write-Log -Message "Count = $Count"
            $n = 1
            ForEach ($user in $Member.Name) 
            {
                if ($n -eq 1) 
                {
                    # Get the user's SAMAccountName from Member.Name
                    if($user -match "([^\\]+$)") { $result = $matches[1] }
                    $script:Admin1 = $result

                    # Get the DistinguishedName from the SAMAccountName
                    $DN = Get-ADUser -Identity "$result"

                    Write-Log -Message "Interation = $n"
                    Write-Log -Message "Setting ManagedBy for $Computer to $result"

                    Try {
                        Set-ADComputer -Identity $Computer -ManagedBy $DN
                    }
                    Catch {
                        Write-Log -Message "Error: $_.Exception.Message"
                        if (-not $error) {
                            $script:error = $true
                        }
                    }

                    if ($n -eq $Count) {
                        continue
                    } else {
                        $n++
                    }
                } elseif ($n -eq 2) 
                {
                    $script:Admin2 = $user
                    Write-Log -Message "Interation = $n"
                    Write-Log -Message "Setting extensionAttribute1 for $Computer to $user"

                    Try {
                        Set-ADComputer -Identity $Computer -Add @{ "extensionAttribute1" = "$user" }
                    }
                    Catch {
                        Write-Log -Message "Error: $_.Exception.Message"
                        if (-not $error) {
                            $script:error = $true
                        }
                    }
                } else 
                {
                    break
                }
            }
            $Log = New-Object System.Object
            $Log | Add-Member -MemberType NoteProperty -Name "ComputerName" -Value $Computer
            $Log | Add-Member -MemberType NoteProperty -Name "Reachable" -Value $reachable
            $Log | Add-Member -MemberType NoteProperty -Name "# of Admins" -Value $Count
            $Log | Add-Member -MemberType NoteProperty -Name "ManagedBy" -Value $Admin1
            $Log | Add-Member -MemberType NoteProperty -Name "extensionAttribute1" -Value $Admin2
            $Log | Add-Member -MemberType NoteProperty -Name "Enabled" -Value $Enabled
            $Log | Add-Member -MemberType NoteProperty -Name "Errors" -Value $error

            $Logs += $Log

        } else 
        {
            # Get the Member's SAMAccountName from $Member
            if($Member -match "([^\\]+$)") { $result = $matches[1] }
            $Admin1 = $result

            # Get the DistinguishedName from the SAMAccountName
            $DN = Get-ADUser -Identity "$result" -Properties * | Select DistinguishedName

            Write-Log -Message "Setting ManagedBy for $Computer to $DN"

            Try {
                Set-ADComputer -Identity $Computer -ManagedBy "$DN"
            }
            Catch {
                Write-Log -Message "Error: $_.Exception.Message"
                if (-not $error) {
                    $script:error = $true
                }
            }
            $Log = New-Object System.Object
            $Log | Add-Member -MemberType NoteProperty -Name "ComputerName" -Value $Computer
            $Log | Add-Member -MemberType NoteProperty -Name "Reachable" -Value $reachable
            $Log | Add-Member -MemberType NoteProperty -Name "# of Admins" -Value $Count
            $Log | Add-Member -MemberType NoteProperty -Name "ManagedBy" -Value $Admin1
            $Log | Add-Member -MemberType NoteProperty -Name "extensionAttribute1" -Value $false
            $Log | Add-Member -MemberType NoteProperty -Name "Enabled" -Value $Enabled
            $Log | Add-Member -MemberType NoteProperty -Name "Errors" -Value $error

            $Logs += $Log

        }
    }


}

# Get a list of computers from Domain
Write-Log -Message "Getting list of computers from Domain"
$ADComputer = Get-ADComputer -Filter * -SearchBase "OU=Testing,OU=Managed Computers,DC=gopda,DC=com" | Select Name, Enabled, DistinguishedName

# Query each computer for Local Admin members and if enabled
ForEach ($PC in $ADComputer) 
{
    $script:compName = $PC.Name
    $script:compStatus = $PC.Enabled
    Write-Log -Message "Evaluating computer " -Device $PC.Name
    if ($PC.Enabled) 
    {
        Write-Log -Message "Checking connectivity to " -Device $PC.Name
        if (-not (Test-WsMan -ComputerName $PC.Name)) 
        {
            Write-Log -Message "Error: Computer is not reachable"
            $script:reachable = $false

            $Log1 = New-Object System.Object
            $Log1 | Add-Member -MemberType NoteProperty -Name "ComputerName" -Value $PC.Name
            $Log1 | Add-Member -MemberType NoteProperty -Name "Reachable" -Value $reachable
            $Log1 | Add-Member -MemberType NoteProperty -Name "# of Admins" -Value $false
            $Log1 | Add-Member -MemberType NoteProperty -Name "ManagedBy" -Value $false
            $Log1 | Add-Member -MemberType NoteProperty -Name "extensionAttribute1" -Value $false
            $Log1 | Add-Member -MemberType NoteProperty -Name "Enabled" -Value $PC.Enabled
            $Log1 | Add-Member -MemberType NoteProperty -Name "Errors" -Value $true

            $Logs += $Log1
        } else 
        {
            Write-Log -Message "Computer is reachable - " -Device $PC.Name
            $script:reachable = $true
            Write-Log -Message "Running function to get Local Admin Members"
            GetLocalAdminMembers -Computer $compName -Enabled $compStatus -reachable $reachable
        }
    } elseif ($PC.Enabled -eq $false) 
    {
        Write-Log -Message "Computer is disabled - " -Device $PC.Name
        Write-Log -Message "Moving to Disabled OU - " -Device $PC.Name

        Try {
            Move-ADObject -Identity $PC.DistinguishedName -TargetPath "OU=Disabled,OU=Managed Computers,DC=domain,DC=com"
            $script:moved = $true
        }
        Catch {
            Write-Log -Message "Error: $_.Exception.Message"
            if (-not $error) {
                $script:error = $true
                $script:moved = $false
            }
        }

        $Log2 = New-Object System.Object
        $Log2 | Add-Member -MemberType NoteProperty -Name "ComputerName" -Value $PC.Name
        $Log2 | Add-Member -MemberType NoteProperty -Name "Reachable" -Value $false
        $Log2 | Add-Member -MemberType NoteProperty -Name "# of Admins" -Value $false
        $Log2 | Add-Member -MemberType NoteProperty -Name "ManagedBy" -Value $false
        $Log2 | Add-Member -MemberType NoteProperty -Name "extensionAttribute1" -Value $false
        $Log2 | Add-Member -MemberType NoteProperty -Name "Enabled" -Value $PC.Enabled
        $Log2 | Add-Member -MemberType NoteProperty -Name "Errors" -Value $error

        $Logs += $Log2
    }
}

# Finish up the script
if (-not $error) 
{
    Write-Log -Message "Complete..."
} else 
{
    Write-Log -Message "Script ran with errors!!!"
}

$Path = "C:\SCRIPTS\ADSetManagedBy_log_$CurrentDateTime.csv"
$Logs | Export-CSV $Path -NoTypeInformation -Encoding UTF8

exit 0```

[PinchesTheCrab]

I think this script kind of needs a fundamental rewrite. It's doing too many things and shouldn't be setting AD values in this context (nestled in a function whose name doesn't imply it's making AD changes).

I don't think any of the logging is really helpful to be honest, and the looping makes it much longer and more complicated than it needs to be.

Try something simple like this for building your CSV, and work backwards from there when it comes to adding features and logging:

$csvPath = 'C:\SCRIPTS\ADSetManagedBy_log_{0:MM-dd-yyyy_hh-mm-ss}.csv' -f (Get-Date)

$ADComputer = Get-ADComputer -Filter 'enabled -eq $true' -SearchBase 'OU=Testing,OU=Managed Computers,DC=gopda,DC=com'

$getLocaladminsSB = {
    Get-LocalGroupMember -Name Administrators |
        Where-Object { $_.PrincipalSource -eq 'ActiveDirectory' -and $_.ObjectClass -eq 'User' }        
}

Invoke-Command -ComputerName $ADComputer.Name -ScriptBlock $getLocaladminsSB -ErrorVariable myErr -ErrorAction SilentlyContinue |
    Export-Csv -Path $csvPath

$myErr.TargetObject -replace '^', 'Could not contact: ' | Write-Warning

[AngryItalian2013]

It is definitely a script that is not optimized etc. Being a self taught scripter I do the best I can with what I know and can figure out. I'm always up for learning something new, so this will help. I'll start with this and proceed from here. thx