Script snippet error perhaps?

I have written a script which includes logging into Azure, looking at the resources within the subscription, and then I want to pull out the resource names of resources that do not have a resource manager 'lock' applied to it. The script only appears to do exactly the opposite, runs without error, producing the text file but only reports just the single locked resource in my subscription, and hence, not the resources without locks.  I'm hoping someone can spot an obvious error here?
Thank you for looking:

Login-AzureRmAccount
select-azurermsubscription NameOfAzureSubHere
$rgs = Get-AzureRMResourceGroup
foreach ($rg in $rgs) {$Resourcess = Get-AzureRMResource}
foreach ($rgs in $resources) { if ($rg.Lock -eq $null) { echo $rg.Name, $rg.ResourceType } }
get-azurermresourcelock | out-file -FilePath C:\Temp\unlocked.txt
LVL 1
Jason ThomasAsked:
Who is Participating?
 
footechCommented:
I tested my code when I had placed a lock on one Azure VM and it correctly listed every other resource except that one.  So I'm wondering why it wouldn't work for you.
In the same way the following should just show the resources with a lock on them.
Compare-Object -ReferenceObject (Get-AzureRmResource) -DifferenceObject (Get-AzureRmResourceLock) -Property ResourceName -IncludeEqual -ExcludeDifferent

Open in new window


Although LockId is a property returned by Get-AzureRmResourceLock, it is not returned by Get-AzureRmResource.  And Get-AzureRmResourceLock doesn't return resources that don't have a lock.

I see some basic problems with Ben's code.  $Resources will be the same each time through the loop.  Get-AzureRMResource gets all resources within a subscription.  Even if you tried to use $rg with Get-AzureRMResource, you can't really limit it to just return resources within a resource group, so you can omit the whole foreach ($rg in $rgs) loop.  If you really needed to return info about resources within a specific resource group, you could use Find-AzureRMResource.
0
 
footechCommented:
Your variable usage isn't consistent.
$Resourcess vs. $resources
Your loop foreach ($rg in $rgs) {$Resourcess = Get-AzureRMResource} will overwrite $Resourcess each time.
Later you query $rg.Lock inside a foreach loop where the current variable is $rgs.
0
 
DBAduck - Ben MillerPrincipal ConsultantCommented:
Something like this.

Login-AzureRmAccount
select-azurermsubscription NameOfAzureSubHere
$rgs = Get-AzureRMResourceGroup
foreach ($rg in $rgs) {
     $Resources = Get-AzureRMResource
     foreach ($resource in $resources) { 
             if ($rg.Lock -eq $null) { 
                  "$($rg.Name), $($rg.ResourceType)" | Add-Content C:\Temp\unlocked.txt 
             } 
      }
} 
# get-azurermresourcelock | out-file -FilePath C:\Temp\unlocked.txt

Open in new window

0
Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

 
Jason ThomasAuthor Commented:
Hi both and thank you. I appreciate the feedback @ footech, that will help me to understand what I am doing wrong vs just getting the answer.
@ DBAduck- thank you. I just ran the new script and watched the unlocked.txt file size going up and up, so was very hopeful. I only have one resource with a lock on so I should get a list of all other resources if it works. But take a look at what was returned - I get the only resource WITH a lock and then these weird characters that go on down the page, note, I have not copied the entire results as those characters go on a couple of hundread times. . It's as though the $null is being ignored?

Name                  : oorttest
ResourceId            : /subscriptions/***********************
c2979beb635d/resourceGroups/OORT/providers/Microsoft.Network/virtualNetworks/OORT/provid
                        ers/Microsoft.Authorization/locks/oorttest
ResourceName          : OORT
ResourceType          : Microsoft.Network/virtualNetworks
ExtensionResourceName : oorttest
ExtensionResourceType : Microsoft.Authorization/locks
ResourceGroupName     : OORT
SubscriptionId        : ******************************
Properties            : @{level=ReadOnly; notes=}
LockId                : /subscriptions/3772683f-1d36-4b8b-940e-c2979beb635d/resourceGroups/OORT/providers/Microsoft.Network/virtualNetworks/OORT/provid
                        ers/Microsoft.Authorization/locks/oorttest



,
,
,
,
,
,
,
,
,
0
 
footechCommented:
I was doing a little research here.
If you have a lock on single resource, I don't think there's any property of the resource that reflects that.  The $rg.lock check might work if you locked the resource group, but I don't know.
From what I know, I would suggest just running Get-AzureRmResource to get all resources in a subscription, and comparing that with Get-AzureRmResourceLock.
Compare-Object -ReferenceObject (Get-AzureRmResource) -DifferenceObject (Get-AzureRmResourceLock) -Property ResourceName -Passthru | Select Name,ResourceType | Export-Csv unlocked.csv -notype

Open in new window

0
 
DBAduck - Ben MillerPrincipal ConsultantCommented:
My script may have been flawed. I left the Resource Group $rg.Lock in the mix, it should have been the resource.

Login-AzureRmAccount
select-azurermsubscription NameOfAzureSubHere
$rgs = Get-AzureRMResourceGroup
foreach ($rg in $rgs) {
     $Resources = Get-AzureRMResource
     foreach ($resource in $resources) { 
             if ($resource.Lock -eq $null) { 
                  "$($resource.Name), $($resource.ResourceType)" | Add-Content C:\Temp\unlocked.txt 
             } 
      }
} 
# get-azurermresourcelock | out-file -FilePath C:\Temp\unlocked.txt

Open in new window

0
 
Jason ThomasAuthor Commented:
Thank you both. I'll try these tomorrow. Appreciate your time.
0
 
Jason ThomasAuthor Commented:
Hi both. Tested both options this morning, both produce the same result, they include all resources despite whether a lock is applied or not. I tested this by running the script, producing the results and then locked additional resources these new locked resources still get displayed in the result.

I think footech is right, perhaps there is not property type to lock onto for the script to run. The only think that may suggest other, if I run this: get-azurermresourcelock | out-file -FilePath C:\Temp\unlocked3.txt   It produces the only 2 resources with a lock. And if you look at the output below, there is a property called "LockID" shouldn't we be able to use this in our search?


Name                  : MySub
ResourceId            : /subscriptions/*************************-c2979beb635d/resourceGroups/OORT/providers/Microsoft.Network/virtualNetworks/MySub/providers/Microsoft.Authorization/locks/MySub
ResourceName          : OORT
ResourceType          : Microsoft.Network/virtualNetworks
ExtensionResourceName : oorttest
ExtensionResourceType : Microsoft.Authorization/locks
ResourceGroupName     : OORT
SubscriptionId        : ****************************
Properties            : @{level=ReadOnly; notes=}
LockId                : /subscr****************************
resourceGroups/OORT/providers/Microsoft.Network/virtualNetworks/OORT/providers/Microsoft.Authorization/locks/MySub

Thanks both for looking.
0
 
DBAduck - Ben MillerPrincipal ConsultantCommented:
What about using the ResourceName in the loop?

Login-AzureRmAccount
select-azurermsubscription NameOfAzureSubHere
$rgs = Get-AzureRMResourceGroup
foreach ($rg in $rgs) {
     $Resources = Get-AzureRMResource
     foreach ($resource in $resources) { 
             if ( (Get-AzureRMResourceLock -ResourceName $resource.Name) -eq $null) { 
                  "$($resource.Name), $($resource.ResourceType)" | Add-Content C:\Temp\unlocked.txt 
             } 
      }
} 

Open in new window

0
 
Jason ThomasAuthor Commented:
Oh! I just retried both snippets and as you say footech, it appears to work :) Let me re-test, make sure i haven't missed anything.
0
 
Jason ThomasAuthor Commented:
Thanks so much and sorry for the late feedback I've been away. Those 2 lines of code worked great for what I was after.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.