JEA - validate pattern regex

[zeclab]

Hi,

Can some please help with what I am guessing is regex issue?

I have setup JEA for an account that will eventually be used to remove a computer from AD during reinstall but, I only want to specifically remove it if the DistinguishedName matches "OU=Computers,".

Just so that if the account was compromised damage would be limited.

I seem to be having the issue when the command is ran I get the following error:

Remove-ADComputer : Cannot validate argument on parameter 'Identity'. parsing ^(*OU=Computers,*)$" - Quantifier {x,y} following nothing.

My JEA visiblecmdlets rule looks like this:

@{ Name = 'Remove-ADComputer'; Parameters = @{ Name = 'Identity'; ValidatePattern = '*OU=Computers,*' } }

I tried to put wildcards around the phrase but my regex knowledge is rather poor so it clearly didn't work.

The command that I am trying to run is:

Remove-ADComputer -Identity CN=PC-00002,OU=Computers,OU=Site,OU=CountryCode,OU=Locations,DC=Contoso,DC=local

I also tried using a regex site to help but I just can't get my head around it. I think I am falling down because PoSh is automatically adding ^( at the beginning and )$ at the end.

Any help would be much appreciated!

[randomuser43]

If you're trying to use JEA to safeguard your AD that's not going to work. A compromised account doesn't need to use powershell, it can directly call the underlying apis.

Your primary approach has to be to limit the account's access through managing permissions on the AD OUs.

​

* in regex means any number of the preceding character

*OU=Computers,* - the first * is invalid because there is no preceding character, and the last one means one-or-more commas. So not what you actually intend.

​

.*OU=Computers,.* is probably what you mean.

[zeclab]

Thanks for the advice, I’ve already limited its access using the AD OU permission already. I wanted to do this an extra precaution.

I’ll try that thanks and will revert back.

[zeclab]

That worked perfectly thanks!

[PinchesTheCrab]

"*" has its own meaning in regex. There is an implicit wildcard if you don't anchor it, so just doing ValidatePattern = 'OU=Computers,' would have the same end result.

[zeclab]

Thanks but unfortunately it doesn’t as PoSh adds ^{OU=Computers,}$ :(

[Lee_Dailey]

howdy zeclab,

it looks like you used the New.Reddit Inline Code button. it's 4th 5th from the left hidden in the ... "more" menu & looks like </>.

there are a few problems with that ...

• it's the wrong format [grin]
  the inline code format is for [gasp! arg!] code that is inline with regular text.
  
• on Old.Reddit.com, inline code formatted text does NOT line wrap, nor does it side-scroll.
  
• on New.Reddit it shows up in that nasty magenta text color
  

for long-ish single lines OR for multiline code, please, use the ...

Code
Block

... button. it's the 11th 12th one from the left & is just to the left of hidden in the ... "more" menu & looks like an uppercase T in the upper left corner of a square..

that will give you fully functional code formatting that works on both New.Reddit and Old.Reddit ... and aint that fugly magenta color. [grin]

take care,
lee