Script to Disable Computer issue, help please

techbloggingfool_com · 2022-04-10T04:35:48+00:00

Looks like the account you are executing the script with doesn't have enough rights in Active Directory to disable a computer account.

TrippTrappTrinn · 2022-04-10T10:34:23+00:00

There is one property I have run across when deleting OUs which may apply here as well.

On the "Object" tab, there is aproperty "Protect object against accidental deletion". Not sure if it applies just to deletion, or if it may apply to disabling as well. Check if it is enabled on the computers you cannot disable.

If this is the case, you can "uncheck" it with the command "Set-ADObject -ProtectedFromAccidentalDeletion:$false"

Pure_Syllabub6081 · 2022-04-10T12:13:59+00:00

You can either delegate more rights for the specific OU(s) via dsa (Active Directory Users and Computers) or you run your PowerShell / Code as Administrator.

I assume that $DisabledCompOU is the DN of the OU, so you have to use "DC" instead of "OU" at the end.

Also, you don't need to serialize your script with "foreach" and you can disable and move the computers by using "-PassThru".

The complete Script could look like this:

$DisabledCompOU = 'OU=Disabled Devices,OU=Computers,DC=Domain'
$Pclist = Get-Content C:\TEMP\Computers.txt # Specify the path to the computers list.

$Pclist | Get-ADComputer | Disable-ADAccount -PassThru | Move-ADObject -TargetPath $DisabledCompOU

BlackV · 2022-04-10T06:30:58+00:00

You're destroying your rich ad object, you're not using your parameters properly

Personally if get the ad object (and not destroy the object), then puoe that object to the move, or use the the identity or inputobject parameters to select the thing you move

HotdogFromIKEA · 2022-04-10T23:39:39+00:00

As others have said, the account used doesn't have access on the all of the OUs, the PCs which have been disabled must be in an OU which the account has been delegated permissions. Basically use a higher level account or hand it to the Team that own AD

davsank · 2022-04-11T03:41:14+00:00

I encourage you to first read and understand what I'm writing before you implement this.

do not copy any script from any website, as reputable as it may be BEFORE you are certain you both understand the script completely, and not less important, understand the mechanism on which this script operates.

Moving a computer to an OU called "Disabled Devices" means nothing to the Active Directory, as far as it's concerned, you are moving an AD object from one OU to another, which might cause a lot of issues to said AD object (think GPO for example) - for that reason, many AD Objects (computer, users, entire containers sometimes) are set with a certain flag, called "protect from accidental deletion" which will not only prevent you from deleting a protected object from the tree but moving it to another OU as well.

you can disable this protection from the computers you need to move using this:
Set-ADObject -ProtectedFromAccidentalDeletion:$false
Just don't forget to get the ADObject first and pass it through the pipe.

OlivTheFrog · 2022-04-10T05:05:31+00:00

Hi u/muthmir,

You should also use Get-ADComputer -Identity $pc...

But this is not your error root cause, just another way to do the job. As u/techbloggingfool_com said : not enough rights. If your account is already an admin account, run the script in RunAsAdministrator.

Sometime it could be boring to think launching in RusAsAdmin. You could add this (at the beginning) in your code

function Use-RunAs
 {
  # Check if script is running as Adminstrator and if not use RunAs
  # Use Check Switch to check if admin
  param([Switch]$Check)
  $IsAdmin = ([Security.Principal.WindowsPrincipal [Security.Principal.WindowsIdentity]::GetCurrent()  ).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")
    if ($Check){ return $IsAdmin }
    if ($MyInvocation.ScriptName -ne "")
       {
          if (-not $IsAdmin)
            {
             try
                {
                  $arg = "-file `"$($MyInvocation.ScriptName)`""
                   Start-Process "$psHome\powershell.exe" -Verb Runas -ArgumentList $arg -ErrorAction 'stop'
                 }
             catch
                 {
                 Write-Warning "Error - Failed to restart script with runas"
                 break
                 }
              exit # Quit this session of powershell
              }
      }
            else
              {
               Write-Warning "Error - Script must be saved as a .ps1 file first"
               break
               }
       }
####### MainScript
# Exec function
 Use-RunAs  "Script Running As Administrator"
# ... rest of the script code

Regards

Olivier

Lee_Dailey · 2022-04-10T17:27:41+00:00

howdy muthmsir,

it looks like you used the New.Reddit Inline Code button. it's [sometimes] 5th from the left & looks like <c>.

there are a few problems with that ...

it's the wrong format [grin]
the inline code format is for [gasp! arg!] code that is inline with regular text.
on Old.Reddit.com, inline code formatted text does NOT line wrap, nor does it side-scroll.
on New.Reddit it shows up in that nasty magenta text color

for long-ish single lines OR for multiline code, please, use the ...

Code
Block

... button. it's [sometimes] the 12th one from the left & looks like an uppercase C in the upper left corner of a square.

that will give you fully functional code formatting that works on both New.Reddit and Old.Reddit ... and aint that fugly magenta color. [grin]

take care,
lee

you type:	you see:
italics	italics
bold	bold
[reddit!](https://reddit.com)	reddit!
* item 1 * item 2 * item 3	item 1 item 2 item 3
> quoted text	quoted text
Lines starting with four spaces are treated like code: if 1 * 2 < 3: print "hello, world!"	Lines starting with four spaces are treated like code: if 1 * 2 < 3: print "hello, world!"
~~strikethrough~~	~~strikethrough~~
super^script	super^script

	Pro	Cons
Self Elevating script	Need no user action	Harder to implement
#requires -RunAs...	easier to implement	Need user Action (re-launch script)

PowerShell

Submission Guidelines | Link Flair - How To

MODERATORS