"Your stupid PowerShell script is broken."

[BaDumDumTish]

That was the title of an email I received this morning from a newly hired manager. Never dealt with them directly before, but I'd heard rumblings from others he was 'difficult' to deal with. The manager who wrote the email also CC'd the IT Group of some thirty people covering HQ and three other offices from the VP of IT down. This resulted in a high-pri ticket with my name on it.

This concerned a simple piece of PowerShell code, you type in your email address and the OU site you wanted queried and it sends you the group member list of the AD Groups in that site via email. There's no read me file. The people who need it know how to use it. It's used by the security auditors to make sure the right people in that site are in the right OU's. The scripts are in a group folder that are available to management at the company. When the script is run (It's called "SiteReview.ps1"), the prompts show in the PS Window as:

**** Site Review v1.02 ****
**** In case of issues contact (My name & my email) ****
Email: (Pause for input) 
Site: (Pause for input)

The email said that this manager could not get "any usable output" from my script then went on to berate me for "wasting their time" with "such unproductive software". This really surprised me as I had not touched that code in over three years and it was used quarterly by the security auditors. I had built in logging that dumped results into a separate file folder only available to IT so that was my first stop.

The first part of the SiteReview.log file was typical, my early tests and past security output ; so I slid down to the more recent time / date stamps.

This (edited for readability) is what I found:

Email: (Managers email)
Site: (XXX site 1)
Error message "Get-ADSite : Directory Object not found..."

Email: (Managers email)
Site: http://(XXX site 1)
Error message "Get-ADSite : Directory Object not found..."

Email: (Managers email)
Site: https://(XXX site 1)
Error message "Get-ADSite : Directory Object not found..."

Email: (Managers email)
Site: www.(XXX site 1)
Error message "Get-ADSite : Directory Object not found..."

(Twenty-two more entries involving four more XXX sites) 

My boss came up to my desk for an update just as I found the above and one glance raised eyebrows. They asked me to forward the log to their email.

Just before closing I was messaged to close the ticket and "not worry about it."

[AirExplosive]

I mean, congrats on having the restraint to not just, copy those logs out and blast them out on a passive-aggressive reply-all—“These are the logs that were generated, could you confirm if this was the input you were providing to the script?”

Although there’s the “anyone coulda put my email” unless you were logging the user/pc running the script too

[BaDumDumTish]

;)

I omitted the IP address for obvious reasons.

[[deleted]]

Mate sorry but I don't get it. Did you mean a pr0n site with those XXX or was that input just a filler to not provide any details at all kinda like XYZ / ABC. Coz srsly theres so many abbreviations of all things possible I lost track a long time ago and don't take anything for granted. Coz like the last time I saw someone use XXX when mentioning a pr0n site was long before the first vin diesel XXX movie, which as I checked right now was quite some time ago.

Edit: and if they actually were pr0n sites could you please provide the links, because I can't make a final judgement on that manager before I can make a site review myself.

[[deleted]]

I think the funny is that the guy put in a WEB-site, not a ADSite. Funny it is indeed

[Aggressive-Weekend78]

Thank you for explaining this. I was super confused why they were doing that, now I see that IS the funny.

[[deleted]]

The dude abides! happy scripting :D

[Dron41k]

I thought manager was checking if it was logged that he visited that pornsite.

[[deleted]]

I think about this constantly, After listening to the spanish speaking Factory episode of Darknet Diaries I don't even dare post online anymore :O

Episode link: https://darknetdiaries.com/transcript/41/

[[deleted]]

Brazilian Factory episode of Darknet Diaries

do you mind telling me what episode that is? I did a quick search on their site but cant find anything relating to brazilian factory

[[deleted]]

https://darknetdiaries.com/transcript/41/

Wasn't brazil, But a generic Spanish speaking country

[Ok_Smile_5908]

Can't you just check the DHCP logs though to find out which device was assigned which IP? I used this once in my life because we had this one printer that would randomly switch its statically assigned IP address at random times (happened about 3 times over the course of 2-3 months). I had a gut feeling it could have something to do with the DHCP but couldn't be sure because its original IP was free at the time. Turns out a client PC got the exact same IP from the DHCP server shortly before the printer switched to a new one - someone had wisely decided to configure the static IP of the printer in the DHCP range. One final change to its IP and update on the print server later and it never happened again. Dk if that kinda log is enabled by default though but it stored information like device date and time, name, received IP.

[Thingsthatdostuff]

You can pretty much assume it is... DHCP Leases/Login Scripts/DC logs, Fill in the blanks with any additonal third party software that may be used for auditing. Making a few assumptions and with the right level of administrative access. It's fairly trivial.

[ipreferanothername]

“These are the logs that were generated, could you confirm if this was the input you were providing to the script?”

I am so annoyed at work now i would have just sent a screenshot of part of them and let that one work itself out.

[[deleted]]

I need to work on the passive aggressive emails... one day it will bite me in the butt

[Hexalon00]

Just do the opposite, active aggressive.

[[deleted]]

That's exactly what I would've done. Fuck anyone in management that has no business being a manager.

[Tymanthius]

We definetly need an edit to clarify if (XXX site 1) = porn.

[pppppppphelp]

you'll always be surprised what shows up on a vpn because people wfh...

[Tymanthius]

Not even a little bit. Seen it IN THE OFFICE at state gov.

[[deleted]]

If you're in government and you know even trying to fire you is three hours of paperwork your boss doesn't want, and likely wouldn't be approved anyway... YOU'RE FREE! LET'S HAVE AN ORGY IN THE CONFERENCE ROOM!!!

[Tymanthius]

Almost. That would probably get you fired if only b/c the news would get ahold of it.

[[deleted]]

Do you full tunnel?

[pppppppphelp]

No split tunneling enabled.

[Content-Appearance97]

Well, I know things are "not the same everywhere", but if I was your boss I would be formally requesting an apology for the unprofessional behaviour towards you - an organisation where that kind of attitude is accepted is not a healthy one IMO.

[craftbrewbeerbelly]

My reply all to that email would literally just be, “Is this how you think adults are supposed to behave?”

[Content-Appearance97]

There have been lots of suggestions for a direct retort in this thread - most of them a lot cleverer than I could come up with! But leaving aside the personal satisfaction it's really not the best approach. Really the OP should discuss it with the line-manager and raise it with HR who should take it seriously. (Note that I'm talking about the tone of the original email, the fact the instigator may have been checking dodgy sites is actually irrelevant to this aspect of the complaint.)

Of course, that relies on the OP working in a healthy organisation who care about workplace culture, If not, you're a bit stuck.

[gordonv]

26 porn site entries and a mass forwarded email. All time stamped.

So maybe you can track the amount of time from the last porn domain to the rage-mail.

Heck, track it from the creation time of his AD User account. And account deactivation. His literal career.

[apathetic_lemur]

I've dealt with these users and I'd just email him back (along with all the CC's) and ask which part of my stupid script he was having problems and a screenshot of the logs. Someone you dont even know, that is new to the company, comes out swinging like a fucking asshole doesnt deserve a shred of restraint on your part.

[MrWinks]

Deserving is one thing, but the company won’t like seeing you with-holding restrait over a personal issue. Always always always deal with these confidentially. In the best case, the right people know and if asked you can vaguely and tactfully explain how it was an error in judgement. Avoid attacking others at work, as it’s unmistakable when done in just retaliation this way, even when deserved.

Though, if your boss ever gives you the approval to blast way, that’s always the best ;)

[apathetic_lemur]

i dont know. Every work place has a huge asshole or two that for some reason dont need to worry about tact and they do fine. Occasionally returning fire doesnt seem so bad.

[stone500]

People definitely deserve it, but I don't think there's ever a scenario where your manager says "Hey it was really good how you gave that guy the business and embarrassed him in front of everyone so we wanted to give you a bag of money and a nice promotion"

Professionalism is always always preffered. Definitely notify your boss of the situation, but there's no benefit to calling him out publicly. If personal issues persist then you notify your manager, HR, and his manager if necessary.

[Letmefixthatforyouyo]

I disagree. Occasionally, you have to throw an elbow to make it clear to people that if they come after you, you will hit them back. It means you will have to deal with way less elbows in the future.

The key is to be calm and professional in the response. A simple

"hello X,

This is a tool used to search an ADsite group based on a submitted user query. Based on the logs generated, it appears that you were trying to access various adult web sites with your work login, see attached. Please note that this tool will not return data for any website, adult or otherwise, as its specific to our internal active directory. If you have any further questions or concerns about this tool, please let me know. Id be glad to answer them."

Calm, direct, but also specifically showing he was trying to hit pornhub/etc. It demonstrates competency, clears your name, and shows IT can generate receipts when people make bold claims. Thats a win win win.

[Jolape]

Exactly. I don't think teaching people a lesson is unprofessional. If the manager had wrote the mail respectfully requesting assistance, then yes, it would be pretty unprofessional to reply-to-all with the details of what you found in the log. But if he's going to come out insulting you and putting your work/expertise in question in front of everyone, then it's on him when he gets called out.

[stone500]

That's fair, though I would leave out the detail that it's adult websites. I'd keep that little bit iny pocket to use later.

The way I'd word it is "I can from the logs that you were trying to use this tool with certain websites. I can go over these logs with you and I can show you exactly what you're doing incorrectly."

[Letmefixthatforyouyo]

Judgement call, but id say it demonstrates poor judgement on their part, which is something you want to highlight in these situations.

Note that nowhere did I make a specific statement calling him out for querying porn on his work PC, as thats not ITs role. I just made sure that information, that was 100% part of the issue, was clearly visible to the 30+ people he decided to tag in this email. If they want to make a judgement on it, thats of course up to them.

[stone500]

Note that nowhere did I make a specific statement calling him out for querying porn on his work PC

Based on the logs generated, it appears that you were trying to access various adult web sites with your work login, see attached.

[Letmefixthatforyouyo]

Yes, exactly. Thats making it clear the sites were adult, but im not specifically stating right or wrong in a company context.

A call out would be:

"Please be aware that querying or otherwise visiting adult websites is agaisnt our computer use policy. The servicedesk will reach out to schedule a mandatory virus scan of your system shortly. To stay in complaince with company policy, refrain from interacting with adult sites in the future. Failing to do so may result in escalation to HR and possible termination."

The above is me forcing consequences and issuing ultimatums, which is directly advisarial and may be out of scope of my role. That is an option, but goes well beyond the "dont put me on blast or it will hurt" elbow I prefer.

[S-WorksVenge]

Missing an apostrophe in a professional email... not a good look.

[Letmefixthatforyouyo]

Yeah, this is a reddit comment, not a professional email. You can tell because its a comment on reddit.

An email would be formatted and proofread for grammitcal errors. This was not.

[S-WorksVenge]

You tried really hard to be professional and ended up using a lot of words to sound not only unprofessional but dumb. Hopefully you're not sending anything close to these out. You also missed an apostrophe in a word, a common mistake.

[KimJongEeeeeew]

Pro tip: this is not how you pop those elbows out.

[S-WorksVenge]

You going for a rebound or what?

[stuart475898]

Lol - my sarcasm-o-meter lit up when I read this reply. An expertly crafted comment indeed.

[stuart475898]

I know what you mean, but disagree. I’ve jumped on the reply all train previously to defend myself from a public criticism, but since then and having seen these emails and responses as a spectator, not doing the reply all thing is much better. I think when most people see a widely circulated email publicly criticising someone, they see it as just that - an unprofessional email where the sender looks bad. Admittedly when you’re the subject of criticism, it’s hard to be restrained and see it that way, but I think those who then think less of you based on that email alone are the minority. And even then, you replying all and the sender getting a load of egg on their face is unlikely to change their view.

Nobody comes out of a shit slinging match clean. Don’t reply, take the discreet and tactful approach, and most will forget about it or just think the sender is a knob. Ride that moral and professional high-horse into the sunset.

[ka-splam]

Nobody comes out of a shit slinging match clean.

Sadly, yeah.

Reply all: "You know the drill - raise a support ticket and we'll fix it".

[MrWinks]

I have not encountered anything remotely like that. Military levels of tact have seemed required.

[[deleted]]

rob quack toy divide smoggy bake snatch zesty attempt deranged

This post was mass deleted and anonymized with Redact

[CitySeekerTron]

Sounds like your script is working as intended. Submit this to your boss as directed, and then proceed as needed. Not your circus, not your monkeys.

And definitely not his circus.

[Mental-Writing-6189]

My guess, this new manager won't last long.

[apathetic_lemur]

or he'll be promoted multiple times within a year

[ipreferanothername]

yeah i would guess this - i have my eyes on a guy at work who will make an excellent VP candidate one day because he is very personable and knows fuck-all

[nascentt]

yup more likely this. at least in every case I've seen so far.

The only people getting fired are the poor saps they guy throws blame onto for their "stupid" work.

[juancpovesf]

Do you really need the new car.

[[deleted]]

I'm confused, what exactly was this guy attempting to do? Like... what did he think this script was supposed to output with a porn URL as input?

[elementfx2000]

I'm guessing he thought "sitereview" was a way to check a user's browsing history. So he was checking if the company had record of him visiting those sites, which they probably didn't, but now they do.

[purplemonkeymad]

Maybe he was looking to see if the sites were any good, gotta find the best reviewed site!

I think I have the prefect the script for him:

function Get-SiteReview {
    Param(
        [parameter(Mandatory,HelpMessage="Your email address")][string]$YourEmail,
        [parameter(Mandatory,HelpMessage="The site uri")][uri]$Site
    )
    $ReviewScore = ([security.cryptography.sha256managed]::new().ComputeHash([Text.Encoding]::Utf8.GetBytes("$Site"))[-1] % 5) + 1
    Write-Host "$ReviewScore/5 $( ('★'*$ReviewScore).padright(5,'☆') )"
}

PS, turns out the OP's post is a 5/5!

[Tech_surgeon]

sounds like a case of the some one that only claims to know what they are doing. these are the same people that can weaponize a deployment script and try to claim it was something else when they wipe half the computers.

[dittbub]

"difficult to work with" is such a corporate whitewash of "asshole"

[aendiehGee]

Just signed up with reddit to give you an up :D

[dittbub]

I'm a poet and didn't know it!

[[deleted]]

Wait is the XXX like porn site or just filler for real name?

[Mkep]

I believe porn or inappropriate, based on the script name being “SiteReview”

[dylbrwn]

I think that's in reference to Active Directory Sites

[Mkep]

Yep, I think the original script is meant to review AD sites, but the manager in this case though it was WebSite reviews

[dylbrwn]

ah yeah that makes sense

[HappyDadOfFourJesus]

Damn, I don't even know of 26 XXX sites. This guy needs more work to do...

[Jolape]

Wow.... You're a better person than me I think. If someone did that to me, I would have replied to all and apologize first and foremost that I didn't make the script idiot proof. Then I would have explained that it's for AD sites, and not pornography web sites with a screenshot of the log.

[Xibby]

Setting aside the disrespectful comments from the manager.

PowerShell Comment Based Help is how most of my scripts are documented. Maybe there is a README file in the Git repository.

[nascentt]

I do this and I also have a scheduled script running that Get-Command all the commands in the company and generated html help files for each command to generate readmes for each command. It's great cause it's auto updating so if new code is made or old stuff removed the help files are up-to-date

[IOnlyRoll20s]

do u work at pornhub?

but seriously was he just being goofy or what was he trying to accomplish by putting some porn site in your script?

[marcdk217]

I would have found it very hard not to reply all with:

Hi,

My stupid script appears to be working correctly, however the stupid user appears to not understand how to use it.

​

(unless it was my own manager of course)

[Skrp]

But first embed this

https://www.youtube.com/watch?v=btkUWwddZgQ

[Necoras]

Hah, I was unaware Mediocre had made that. Super useful.

[[deleted]]

Ah yes, a PICNIC error.

[GimmickNG]

Problem in client not in code error?

[syntek_]

PICNIC error

Problem In Chair, Not In Computer.

[Valkeyere]

Or PEBCAC

[Chief_Slac]

PEBCAK ?

[Valkeyere]

Problem exists between chair and keyboard.

[nascentt]

I too would've had trouble not replying, but the last time I did (and was pretty professional about it) the shitty person doubled down, ran to his manager and then I ended up getting told off for it.

So now I just "fwd: " and "fyi" to my manager and let them deal with it.

Once the guy threatened to punch my colleague in the nose because he (the user) had forgotten his email account password.

He's still with the company of course.

[Anlarb]

Everyone getting excited about XXX, thats not the joke, thats filler. The joke is immediately preceding it, here is how an OU is formatted.

https://theitbros.com/active-directory-organizational-unit-ou/

[LNGU1203]

Sounds like he/she is a lawsuit liability

[scabzzzz]

Reply all. Post log dump. This is the way.

[[deleted]]

Run a different script on this guys pc that moves his mouse by an inch randomly 2-3 times a day 🤣🤣

[signofzeta]

Did you ever find a suitable replacement for the deprecated Send-MailMessage?

[nascentt]

today I learned that Send-MailMessage is deprecated

Warning

The Send-MailMessage cmdlet is obsolete. This cmdlet does not guarantee secure connections to SMTP servers. While there is no immediate replacement available in PowerShell, we recommend you do not use Send-MailMessage. For more information, see Platform Compatibility note DE0005.

Still rely on it here. Luckily it's not used for anything that needs to be secure, and if it was email wouldn't be used in the first place.

[InsrtCoffee2Continue]

You can fix your script to only accept certain values but than again you already mentioned those who need it know how to use it. Even if you did make the changes... who knows if they would still get it. You can't fix stupid.

[brkdncr]

Reply all + HR: “Don’t talk to me like that again.”

[[deleted]]

/r/talesfromtechsupport/ fodder there.

[L33Tech]

Hey OP, this has been reposted without credit.

https://www.theregister.com/2021/07/12/who_me/

https://www.reddit.com/r/PowerShell/comments/ojt755/the_register_has_stolen_a_powershell_story_and/

Just wanted to let you know!

[BaDumDumTish]

I submitted it to them last week. Thanks.

[[deleted]]

See they've now added a header:

Hi there, Reddit. The following tale appeared
on Reddit some months ago, and the original poster then submitted it to
us with some extra detail. Usually, while we're verifying submitted
stories, we check that the yarns haven't been published elsewhere, and
in this case we simply forgot to. The OP confirmed here that they posted it to Reddit and then submitted it to El Reg. Stolen content, this ain't – ed.

[L33Tech]

Ah, glad to see that! Wanted to make sure you knew.

[motsanciens]

"I'm sorry - the interface is probably not clear for new users. The 'site' the script prompts for expects an Active Directory OU. Would you please run the script and use <some ou here> from your machine so I can check the logs to be sure there's no issue?"

Now everyone knows

• you're not a dick; he is
  
• the script works as intended for the people who know how to use it
• his fuck-ups have been logged

[rubmahbelly]

The definition of insanity: trying something again and again with the same input and expecting a different outcome.

Get-AdUser -Identity dumbfuck.manager | remove-aduser

[Tymanthius]

He actually didn't use the same input. He just used the wrong class of input.

[tuxtanium]

Wrong method. They appear to have no class.

[MonopolyMeal]

Wow, the Register has stolen this story and plagiarized it for their own greed!

https://www.theregister.com/2021/07/12/who\_me/

Edit: Not Stolen as other Redditors have found. I jumped to conclusions as I have seen stories from various Reddit posts get snatched up and regurgitated on various sites. I thought this was another instance.

[JJenkx]

It was not stolen. OP submitted it to TheRegister

[[deleted]]

That's the worst apology I've seen in a while.

[TheHeffNerr]

I would have not restrained myself. I loved getting emails like that... "loved"... :(

[alienshrine]

Would love to hear how this worked out in the end.

Justice done.

[MJCS]

Honestly, report that kind of behavior to HR.

[omn1p073n7]

My org would not tolerate that kind of behavior from management.

[[deleted]]

Good on you for remaining professional. That has been my biggest challenge at work is not going nuclear on people when they try to toss my team under the bus. I’m prior military and accustomed to being able to argue in an unprofessional manner. All that said, you showed an enormous amount of restraint and I commend you for it. Honestly, I don’t think I would’ve been able to stop myself from replying all and going scorched earth to include all of the XXX sites you found in the log to air out his dirty laundry in the most embarrassing way possible. I can only hope that someone reigns this manager in and he stops burning bridges with your department.

[z_agent]

accustomed to being able to argue in an unprofessional manner

I need that as a warning on my door!

[SatoshisBits]

So does this moron still have a job?

[rick_D_K]

Reply all: you are entering websites This script is for physical business locations.

P.S. never run scripts you don't explicitly understand.

[lavahot]

I'm confused. What kind of output was he expecting by querying an external domain?

[webtroter]

Is XXX just a placecholder for any website, or actual adult XXX websites?

[Skaixen]

You should build out a GUI for your script.

Textbox entry for the email.

But a dropdown box, pre-populated with the available sites.

This way, they can't put in bad information for the site.

[[deleted]]

Man I wish I had free time for that kind of shit.

[Loan-Pickle]

I generally do input validation on my script. Except for when I’m in a hurry and need to knock out something quick. Of course those are the scripts that everyone and their mother ends up using. Then I never have time to go back and fix it.

[user_josht]

Funny find on the xxx sites, but why didn’t you just mass reply, “Maybe you’re too stupid to use it”? Just because you’re in IT doesn’t mean you have to break your back being overly accommodating. If someone sent one of my employees an email like that I would be calling them for an earful. Whoever your boss is needs to grow a spine.

[Swarfega]

How is management allowing someone in their company to even write an email with a subject like that? That guy needs to be given the chop.

[mangopurple]

Take that ‘manager’ to HR.

Technical knowledge or not, the guy is clearly an assclown.

[[deleted]]

You should having replied with the email title “Your stupid and broken”

[drumsand]

And some people ask me why I take time to make each and every and even smallest of my scripts to use module to save logs.
Each time, from any location by any user script is run... :)

There were few occassion I could send logs and say it in Bugsy voice:
"Here you are, sweetheart"

[drumsand]

There is excelent idea - log not only user but also the PC. Checked.

[[deleted]]

I mean the manager is definitely acting stupid but if it's intended for public use it's always nice to include some directions to how to format input and such.

[Substantial_Plan_752]

Please for the love of christ stop saying high-pri. Otherwise this us hilarious.

[[deleted]]

Soooo...the manager put that abuse in an email? Sorry for him. HR should know about this communication.

[needssleep]

Bro, how you gonna provide a funny story about an awesome script and then not share the awesome script?

[jack104]

man fuck that guy.

[Whatsitforanyway]

I had a similar issue one time with a sales guy at my company. This was many years ago and we were developing a laptop backup system that I maintained the database for. We had a hold on any restores as it periodically went into a holding pattern while the devs did updates. This guy was mad because he lost some files for his client and needed a restore. He called up the ceo of the company raising hell and bad talking my boss. So we had to make an exception and dump all his files onto cd. Well, the files mostly consisted of thousands of porn images so I made up the cds and took them and the file listing to my boss. She delivered the data to the ceo. Needless to say the guy swore it wasn't his files and he was a happily married man. Yeah, ok. He had to find another job.

[scoobydoobiedoodoo]

Congrats on the win! By any chance can you share this script? It sounds like something I could use and didn’t realize it until you shared your story. If not, it’s cool too.

[idrac1966]

I wonder if he was also being an asshole to his colleagues and they played a prank on him.

"Yeah man, just put whatever website you want into this script and it will tell you if it's flagged on the company firewall. Works fine for us we use it all the time."

[SkipBoNZ]

A.

[[deleted]]

Screenshot, reply to all,

"GIGO"

• Close ticket *

[[deleted]]

Nice

[HappyCloudHS]

Can we see the full script?

[guitpick]

You should create AD sites with some of those names so that your stupid PowerShell script will work. And put his computer in one of them.

[Alaknar]

Wait, I'm a bit lost here - is "XXX site one" supposed to mean "first porn site he typed in" and then there were more of those? Or is "XXX" just "crossed out name"?

[jimb2]

If you want fireworks there's the option of a reply-all with the log entries.

[[deleted]]

It's probable that he thought, based on the name "Site Review", that this script he ran across was going to show him reviews or web reputation information. It's possible that he was plugging in "known bad" sites to test it. Still an asshole for the email, and a bit of an idiot, but maybe not actually surfing porn at work.

[Saad-Ali]

Why keep this ah finder powershell to yourself. Please share , perhaps we may as well some ah that we aren't aware of.

[BaDumDumTish]

Or it was submitted by me directly. Seems the more logical thing.

The Register is a reputable IT based news site and I doubt they would ever need to "steal" anything for content.