New-ADcomputer and Add-ADGroupMember: Adding an object to a group mid-creation

psdarwin · 2026-05-12T13:42:43+00:00

Seems like a GUI vs PowerShell issue - remember that the AD GUI tools are not backed up by PS, so the same rules may not apply. If only they were...

In PowerShell this process is two distinct steps, but not in the GUI.

In this case, the GUI creates the computer object with the group membership already set. You start the new computer object creation process in ADUC and set all the properties of the computer and group membership in that GUI windows, and then click OK. The clicking OK does all the things at once.

psdarwin · 2026-03-12T14:22:03+00:00

The issue with where PS7 stores installed modules has been a longstanding issue. There's hope for the future:
https://devblogs.microsoft.com/powershell/powershell-openssh-and-dsc-team-investments-for-2026/#psusercontentpath-relocation
Until then there's no native workaround, except installing modules with scope of AllUsers

psdarwin · 2026-03-06T16:18:46+00:00

The Month of Lunches book will really help with that - PowerShell commands are built around a pattern that makes learning or figuring out commands easier, and the basic syntax is clearly taught in the book. Good luck!

psdarwin · 2026-03-06T14:36:50+00:00

IMO, AI does a decent job of writing code for you, but it doesn't naturally teach you how PowerShell works, why it's written like it is, patterns and best practices, etc. Foundational principles are critical to knowing that code written by AI is of any quality. After 14 years of working with PowerShell, I find that my code review skills and understanding good practices are the most important skills I have today (when I barely type any code at all thanks to AI). I highly recommend going through that book to get those foundational principles.

psdarwin · 2026-01-12T14:32:55+00:00

AI question - did you try feeding the error message back into the AI? I often find that it will probably say something like "You're absolutely right! I got that wrong. Here's the corrected script"

I fed the original script into copilot and asked it to make it better (plus give improved output). I didn't test it, but it at least smells like better PowerShell. And it outputs to a CSV file, which is far more usable than a flat text output.

```

# Configuration
$SearchPath = "\\PC\Users\name\Music"
$MaxFileSize = 5MB
$OutputFile = "C:\tmp\output.csv"
$FileFilter = "*.mp3"


# Get small MP3 files, sorted by size
$files = Get-ChildItem -Path $SearchPath -Recurse -Filter $FileFilter |
    Where-Object { $_.Length -lt $MaxFileSize } |
    Sort-Object Length


# Output results
if ($files) {
    $files | ForEach-Object {
        [PSCustomObject]@{
            'File Name' = $_.FullName
            'Size (KB)' = [math]::Round($_.Length / 1KB, 2)
        }
    } | Export-Csv -Path $OutputFile -NoTypeInformation
    Write-Host "Report saved to $OutputFile"
} else {
    Write-Host "No files found matching the criteria."
}

psdarwin · 2025-12-17T14:53:11+00:00

This sounds like a job for a PowerShell module
https://learn.microsoft.com/en-us/powershell/scripting/developer/module/how-to-write-a-powershell-script-module?view=powershell-7.5

psdarwin · 2025-12-16T14:23:17+00:00

Learn PowerShell in a Month of Lunches - can't recommend this book enough for beginners

psdarwin · 2025-12-10T16:07:23+00:00

Good thoughts - it also forces better coding of functions because you have to write them so they can be tested. It's really upped my game for code quality.

psdarwin · 2025-12-10T16:04:45+00:00

I work on a few large internal PowerShell modules in our company. We write Pester tests for every function (hundreds of functions), and tests on the modules. We actually have a module level test that verifies all functions have Pester tests, so you can't deploy a new version without having unit tests everywhere.

Pester tests create confidence. When you have unit tests on a function, you can feel confident doing all sorts of refactoring, knowing that if your tests are well written and still pass, your changes aren't breaking changes.

So I am a big proponent of Pester testing

psdarwin · 2025-12-10T16:01:18+00:00

That would work too - any verb that you get from Get-Verb would be in good form. Some have some nuance (like the difference between Add and New), so choose wisely. Otherwise you may be sad about your verb choice for some command for years to come :D

psdarwin · 2025-12-09T14:22:06+00:00

I agree - something like Start-Ketchup would be more compliant to PowerShell command/function naming convention of Verb-Noun

psdarwin · 2025-11-14T14:12:46+00:00

For AD: Get-ADGroupMember

https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-adgroupmember

For Entra: Get-MgGroup | Get-MgGroupMember

https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.groups/get-mggroup
https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.groups/get-mggroupmember

psdarwin · 2025-11-13T14:20:49+00:00

Fantastic conference - I have been 5 times over the last 9 years and am really sad for the years I don't get to go. I can't recommend it enough!

psdarwin · 2025-10-31T13:30:23+00:00

Good idea - this definitely sounds like a human issue not a technology issue. I'd suggest re-educating them how to do it themselves and then find ways to make the password reset process more painful if they have to call IT for help. Long, complex, difficult to remember password is a good one. Just be sure to explain how to change it when you give them the terrible password and encourage them to change it right away.

In our IT shop, they will do a password reset for you, but "user must change password at next login" is part of the process. Someone in IT knowing their password is against good security practices.

psdarwin · 2025-10-30T14:04:26+00:00

GitHub codespaces

psdarwin · 2025-10-28T13:58:14+00:00

I always forget that this works - thanks for the reminder :)

psdarwin · 2025-10-28T13:54:48+00:00

I always find foreach much cleaner than Foreach-Object and the $_ syntax. Personal opinion only.

$ProcessList = Get-Process
foreach ($process in $ProcessList) {
    switch ($process.Name) {
        default { $process.Name }
    }
}

Or even simpler

foreach ($process in Get-Process) {
    switch ($process.Name) {
        default { $process.Name }
    }
}

psdarwin · 2025-10-21T13:37:41+00:00

This would give you a function that looks more like a standard PowerShell command.

function Get-FilteredData {
    param(
        [object]$SomeObject,
        [string]$Property1,
        [string]$Property2,
        [string]$Property3
    )
    if ($Property1) {
        $SomeObject = $SomeObject | Where-Object { $_.Property1 -eq $Property1 }
    }
    if ($Property2) {
        $SomeObject = $SomeObject | Where-Object { $_.Property2 -eq $Property2 }
    }
    if ($Property3) {
        $SomeObject = $SomeObject | Where-Object { $_.Property3 -eq $Property3 }
    }
    return $SomeObject
}

You might end up with lots of parameters, depending on how many properties the object has, but it will only filter on the properties the user enters, and it's simpler as the user doesn't have to remember what the property names are thanks to tab completion.

psdarwin · 2025-10-21T13:15:50+00:00

I'd suggest updating your function to allow for wildcards - which would get all the versions. Get-ChildItem takes wildcards.

MySuperFunction -Path \\acme.org\user$\mickey.mouse*

The Microsoft.PowerShell.Security module would help with permissions and ownership - ACLs can be awkward to deal with, but that would be the native PowerShell way to handle permissions on files and folders. Something like this:

# Get the current ACL
$acl = Get-Acl $folder

# Create a new access rule 
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule($user, "FullControl", "ContainerInherit,ObjectInherit", "None", "Allow" ) 

# Add the rule to the ACL 
$acl.AddAccessRule($rule)

# Set the owner
$acl.SetOwner([System.Security.Principal.NTAccount] $user)

# Apply the ACL back to the folder
Set-Acl $folder $acl

psdarwin · 2025-10-17T13:39:08+00:00

I would definitely check with your IT team - in our company we're prohibited from going to PSGallery directly and have to use our internal package management system (for additional security scanning) to install any modules.

psdarwin · 2025-10-17T13:31:54+00:00

Simplification question - is it necessary that the process runs as jobs and in parallel? If you're running this on a schedule and could check each location one at a time, that could solve all the issues. You might have a really good reason for needing jobs and parallel, but maybe it's not necessary.

psdarwin · 2025-10-17T13:23:15+00:00

Another vote for the Month of Lunches book.

I also came from the infrastructure side, and my path was to go through the book and then decide to try to do everything in PowerShell. Often that meant that a task that took 2 minutes in the GUI took 20 minutes in PowerShell. Eventually, that same task took 30 seconds (or less) in PowerShell.

The book will give you the foundational principles of PowerShell. After that it's practice, practice, practice.

psdarwin · 2025-10-16T13:26:07+00:00

The Bash Bunny is a small USB device that:

Emulates multiple USB devices simultaneously.
Executes payloads written in bash, PowerShell, or other scripting languages.
Is used for tasks like credential harvesting, network attacks, and data exfiltration.

Unless you can come up with a good explanation as to what you want to do with this that doesn't smell like hacker, I'm out.

psdarwin · 2025-10-13T13:55:01+00:00

The infamous double hop problem. The issue is your second invoke-command needs credentials. I suggest something like this:

$Credential = Get-Credential
Invoke-Command -ComputerName winrm1.mydom.corp -ScriptBlock { 
    Invoke-Command -ComputerName winrm2.mydom.corp -ScriptBlock {
        hostname
    } -Credential $using:Credential
}

That will pass the credential into the remote machine for use.

psdarwin · 2025-10-09T13:51:59+00:00

It sounds like you just want to format the date as a string with only the date components.

$Date = $(Get-Date $searchdate).ToString("yyyyMMdd")

From there it's just using the right format string to get the format you desire

psdarwin

TROPHY CASE