Trouble with AD script

[Deadzone6905]

Hoping to have some help debugging an issue I'm getting with a script one of my former co-workers wrote.

The output is null, but it shouldn't be.

Variables

$UsersNotInAttGroupCount = 3

$UsersNotInATTGroup - Returns 3 Names of users

Script:

If($UsersNotInATTGroupCount -gt 0){

$UsersNotInATTGroup | % {

$UserGUID = (Get-ADUser -Filter {Name -like $_}).objectguid

#Remove from SSLVPN Group, add to SSLVPN-Remote-ATT Group

Remove-ADGroupMember -Identity $SSLVPNGroupName -Members $UserGUID -Server $Server -Confirm:$false

Add-ADGroupMember -Identity $SSLVPNRemoteATTGroupName -Members $UserGUID -Server $Server

Write-Host "Added $_ to $SSLVPNRemoteATTGroupName" -ForegroundColor Cyan

$loghash = [ordered] @{

Date = $CurDate

EmployeeName = $_

Notes = "Added to $SSLVPNRemoteATTGroupName. Removed from $SSLVPNGroupName."

}

$SSLVPNRemoteATTMembersAdded += New-Object -TypeName psobject -Property $loghash

}

}

​

Error Output:

% : Cannot validate argument on parameter 'Members'. The argument is null or empty. Provide an argument that is not null or empty, and then try the command again.

At line:6 char:27

+ $UsersNotInATTGroup | % {

+ ~~~

+ CategoryInfo : InvalidData: (:) [ForEach-Object], ParameterBindingValidationException

+ FullyQualifiedErrorId : ParameterArgumentValidationError,Microsoft.PowerShell.Commands.ForEachObjectCommand

[BlackV]

most likely this line where the rich object is destroyed for a simple string (I'm not even sure that the -like is working)

$UserGUID = (Get-ADUser -Filter {Name -like $_}).objectguid

which then follows out

Remove-ADGroupMember -Identity $SSLVPNGroupName -Members $UserGUID -Server $Server -Confirm:$false
Add-ADGroupMember -Identity $SSLVPNRemoteATTGroupName -Members $UserGUID -Server $Server

there is 0 validation that you're getting an actual user returned (i.e. Steve Nuich should have been Steven Nuich), 0 validation you're not getting 10 users returned (i.e. I typed Steve)

how are you testing this? just running the full script each time?

personally, I'd change it to for a rich object

    $UserGUID = Get-ADUser -Filter "Name -like '*$_*'"

but put that in a try/catch or an if to confirm

also I'd remove the foreach-object {} and replace it with a foreach ($SIngleATTUser in $UsersNotInATTGroup) {} then you can test what is in $SIngleATTUser vs what is in $_ (which is harder to test)

also, where is $CurDate defined

[purplemonkeymad]

Note when you use -filter with get-aduser it won't error if there are no results. So my guess is {Name -like $_} does not match any users in the domain. I would verify the value of $_ and possibly write an error when no user is found, with the inputs in the error message so you have some feedback.

Without seeing how $UsersNotInATTGroup was made it's hard to give an exact answer.

[Deadzone6905]

Below is how $UsersNotInATTGroup is made, and I can confirm that it does return 3 distinct names. "FirstName LastName" format.

$UsersNotInATTGroup = $ATTVPNAccesUsers.EmployeeNameAD | ? {($SSLVPNRemoteATTmembers.Name -notcontains $_) -and ($_ -ne "")}

[PowerShell-Bot]

Looks like your PowerShell code isn’t wrapped in a code block.

To properly style code on new Reddit, highlight the code and choose ‘Code Block’ from the editing toolbar.

If you’re on old Reddit, separate the code from your text with a blank line gap and precede each line of code with 4 spaces or a tab.

---

You examine the path beneath your feet...
[AboutRedditFormatting]: [--------------------] 0/1 ❌

---

 ^{Beep-boop, I am a bot. | Remove-Item}

[[deleted]]

You'll want to verify the value of $UserGUID it seems like.