asked on

PowerShell: Specify specific subproperties to avoid using (*) asterisk

How would I specify a subproperty in this statement?

$users = Get-ADUser -Properties admincount,distinguishedname,canonicalname,nTSecurityDescriptor.AreAccessRulesProtected -Filter *

Open in new window

namely, what currently does not work is: nTSecurityDescriptor.AreAccessRulesProtected

Thank you.

Qlemo

You can't. You have to provide the "top-level" property name, nTSecurityDescriptor, and extract subproperties later in the pipe.

K B

ASKER

Thank you for your reply Qlemo!

Where would I do that in this script:

$users = Get-ADUser -Properties admincount,distinguishedname,canonicalname,nTSecurityDescriptor -Filter * | Sort canonicalname | ? {$_.proxyaddresses -notmatch '($null|SystemMailbox|FederatedEmail|HealthMailbox|migration|SearchMailbox|DiscoverySearch|Administrator|MSExchApproval|MsExchDiscovery)'}
FOREACH ($user in $users) { 
$dn = $user.distinguishedname
$sd = $user.nTSecurityDescriptor.AreAccessRulesProtected
$can = $user.canonicalname -split ‘/’
$OU = $can[0..($can.Count – 2)] -join ‘/’
$admincount = $user.admincount
 New-Object -TypeName PSCustomObject -Property @{
    InheritenceNeedsToBeEnabled=$sd
    dn=$dn
    OU = $OU
    AdminCount = $admincount
}|Export-Csv -Path c:\scripts\IsInheritanceEnabled.csv -NoTypeInformation -Encoding ASCII -Append}

Open in new window

Qlemo

Though I would use some optimization here, your code should work as-is.

K B

ASKER

It produces no output, however, when I use * it works fine.

ASKER CERTIFIED SOLUTION

footech

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

K B

ASKER

Looks great! One thing I noticed is the curly brackets are throwing an error in ISE... any ideas?

K B

ASKER

and yes... they missing property "proxyaddresses" was why I was receiving no output. So thank you for that. However I would like to use your amended code (with the $(FOREACH....)) Not sure where to place the curly brackets to correct the error that is seen in ISE.

Qlemo

I don't think the Export-CSV should append, but that is a different issue.
And correct, you need to retireve the ProxySMTPAddresses property to apply a filter later, of course. Didn't see that in a glance.

SOLUTION

Qlemo

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

Qlemo

This is what I would use (leaving the Append as-is, as I don't know whether it is intentional or not):

Get-ADUser -Properties admincount,distinguishedname,canonicalname,nTSecurityDescriptor,proxyAddresses -Filter * |
  Sort canonicalname |
  ? {$_.proxyaddresses -notmatch '($null|SystemMailbox|FederatedEmail|HealthMailbox|migration|SearchMailbox|DiscoverySearch|Administrator|MSExchApproval|MsExchDiscovery)'} |
  % {
    $dn  = $_.distinguishedname
    $sd  = $_.nTSecurityDescriptor.AreAccessRulesProtected
    $can = $_.canonicalname -split '/'
    $OU  = $can[0..($can.Count – 2)] -join '/'
    $admincount = $_.admincount
    New-Object -TypeName PSCustomObject -Property @{
      InheritenceNeedsToBeEnabled=$sd
      dn=$dn
      OU = $OU
      AdminCount = $admincount
    }
  } | Export-Csv -Path c:\scripts\IsInheritanceEnabled.csv -NoTypeInformation -Encoding ASCII -Append

Open in new window

footech

Aw, crap. Not so great. :(
I completely missed that you had Export-CSV within the foreach statement and using the -append parameter (looked like the closing brace was for the foreach, but really it was for the property hash-table. In that case you can ignore my advice about the subexpression notation (unless you want to move the Export-CSV out of the foreach, but that won't impact presence of any output in the file).

Now I'm thinking your problem was due entirely to the missing proxyaddresses on the -properties parameter of Get-ADUser (it would be included when you used *).

Edit: and now I'm seeing other posts that came in while I was writing this, confirming the issue.