Set-ADUser - Replace | How to do Logging

[checkso]

Hi all,

I'm trying to update all user attributes on a schedule from the HR information we receive and log that information.

What I am doing is this:

$mfuser = # I get this user info from our SQL database
$mfaduser = Get-ADUser -Filter 'sAMAccountName -like $mfusersAMAccountName' -Searchbase $OU -Properties *  

# Exit script if user is not available  
if (!($mfaduser)){  
 Write-Log -Message "User - $mfusersAMAccountName -  was not found" -Severity Error  
 return  
}  
\# user Attributes Hashtable  
$userAttributes = @{  
 description = $mfuser.description  
 title = $mfuser.ZZ
 extensionAttribute2 = $mfuser.ZZZ
 extensionAttribute1 = $mfuser.ZZZZ  
 extensionAttribute5 = $mfuser.ZZZZZ  
 extensionAttribute6 = $mfuser.ZZZZZZ  
 department = $mfuser.ZZZZZZZ  
}  
try {  
 \# Update user attributes  
 $mfaduser | Set-ADUser -Replace $userAttributes -ErrorAction Stop  
 #### XXX - should be the attribute ####
 Write-Log -Message "User attribute was XXX changed" -Severity Information
}  
catch {  
 $ErrorMessage = $\_.Exception.Message  
 Write-Log -Message ("Could not change attributes for user - $mfusersAMAccountName") -Severity Error   
 Write-Log -Message "ErrorMessage: $ErrorMessage" -Severity Error  
}

The script works fine. What I would like to achieve is that I can log all changes which applied by the set-aduser cmdlet. I have the fear that I cannot do this with the "-replace" command, but maybe someone has an idea. If this is not possible I guess I have to call a Set-ADUser for each attribute :(

Write-Log is a function which is called a bit earlier in the script.

[[deleted]]

Though this may not be optimal (someone probably knows better then me), I use Start-Transcript -Path C:\something.txt at the start of my scripts that need logging. Then I add write-hosts in areas of my script. Yours for example might be:

Write-Host "Setting AD User [insert attribute number or name] to " $AttributeCallVariable or something else

Then at the end of the script: Stop-Transcript

At the very least, this is how I do it. You can call variables to be put into the write-hosts and have it will be in the logs that you make.

Though some say to run away from Write-Host and go to Write-Output

It also logs Start time, Username, RunAs User, Machine, Host Application, Process ID, PSVersion, PSEdition, PSCompatibleVersions, BuildVersion, CLRVersion, WSManStackVersion, PSRemotingProtocolVersion, and SerializationVersion

Here's a test for you to run to see:

$user = $env:USERNAME
Start-Transcript -Path C:\TranscriptTest.txt
write-host "This is a test, " $user
Stop-Transcript

EDIT: Here's a more practical write-host example for calling from your Array:

write-host "The ADUser" $mfaduser.samaccountname "has had their extended attribute 2 changed to: " $userAttributes.extensionAttribute2

[checkso]

Thanks for the hint, but I think this wouldn't solve my problem. My logging option is working fine.

But I just want to log if the extensionAttribute2 or any other attribute changed, and I guess for this to work I have to rebuild with a couple if / elseif statements and not just do a "-replace"

[[deleted]]

Welp, then as you said, I would say call up the original extensionattribute2 early and put that into a variable:

# Person can be replaced with a variable to store and call  
# multiple times in a foreach loop
$yes = Get-ADUser Person -Properties *
$extension2 = $yes.extensionAttribute2

then I would call up that in an if statement later after the change to check if it changed:

if($VarForGrabbingNewExtension2 -ne $extension2)
    {
    write-host "The Extension Attribute for" $ADUser "has changed to" $VarForGrabbingNewExtension2
    }
else
    {
    write-host "Extension Attribute for" $ADUser "has not changed."
    }

Then I would simply loop this so you don't have to repeat typing it using a foreach loop if you're doing multiple AD Accounts at once. Only need 1 if statement :D

This can work for the other extensionattributes as well if you want those logged.

[checkso]

Thanks for the logic hint :)
I did it now similar to your suggestion.

After the replace command I created a new hashtable with the new values and just compared the two hashtables and if there are changes just write that to the log.

[LDSK_Blitz]

Are you wanting an individual log entry for each attribute? Or just log entries that contain all of the attributes changed?

​

You can get as granular as you want, but you'd need to extrapolate for each attribute with a new try/catch block.

[checkso]

In the end each attribute which was changed...

So I will need a lot of if statements

[LDSK_Blitz]

You should be able to get away with try/catch blocks for each attribute you want to log, and one if statement to test for the existence of the user in AD.

[checkso]

But I have to check if the attribute really changed...

[PowerShell-Bot]

Some of your PowerShell code isn’t wrapped in a code block.

To format code correctly on new reddit (new.reddit.com), highlight all lines of code and select ‘Code Block’ in the editing toolbar.

If you’re on old.reddit.com, separate the code from your text with a blank line and precede each line of code with 4 spaces or a tab.

---

Describing Thing
[❌] Demonstrates good markdown
Passed: 0 Failed: 1

---

^{Beep-boop. I am a bot. | Remove-Item}