Script snippet error perhaps?

I have written a script which includes logging into Azure, looking at the resources within the subscription, and then I want to pull out the resource names of resources that do not have a resource manager 'lock' applied to it. The script only appears to do exactly the opposite, runs without error, producing the text file but only reports just the single locked resource in my subscription, and hence, not the resources without locks.  I'm hoping someone can spot an obvious error here?
Thank you for looking:

Login-AzureRmAccount
select-azurermsubscription NameOfAzureSubHere
$rgs = Get-AzureRMResourceGroup
foreach ($rg in $rgs) {$Resourcess = Get-AzureRMResource}
foreach ($rgs in $resources) { if ($rg.Lock -eq $null) { echo $rg.Name, $rg.ResourceType } }
get-azurermresourcelock | out-file -FilePath C:\Temp\unlocked.txt
LVL 1
Jay ThomasAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

footechCommented:
Your variable usage isn't consistent.
$Resourcess vs. $resources
Your loop foreach ($rg in $rgs) {$Resourcess = Get-AzureRMResource} will overwrite $Resourcess each time.
Later you query $rg.Lock inside a foreach loop where the current variable is $rgs.
0
DBAduck - Ben MillerPrincipal ConsultantCommented:
Something like this.

Login-AzureRmAccount
select-azurermsubscription NameOfAzureSubHere
$rgs = Get-AzureRMResourceGroup
foreach ($rg in $rgs) {
     $Resources = Get-AzureRMResource
     foreach ($resource in $resources) { 
             if ($rg.Lock -eq $null) { 
                  "$($rg.Name), $($rg.ResourceType)" | Add-Content C:\Temp\unlocked.txt 
             } 
      }
} 
# get-azurermresourcelock | out-file -FilePath C:\Temp\unlocked.txt

Open in new window

0
Jay ThomasAuthor Commented:
Hi both and thank you. I appreciate the feedback @ footech, that will help me to understand what I am doing wrong vs just getting the answer.
@ DBAduck- thank you. I just ran the new script and watched the unlocked.txt file size going up and up, so was very hopeful. I only have one resource with a lock on so I should get a list of all other resources if it works. But take a look at what was returned - I get the only resource WITH a lock and then these weird characters that go on down the page, note, I have not copied the entire results as those characters go on a couple of hundread times. . It's as though the $null is being ignored?

Name                  : oorttest
ResourceId            : /subscriptions/***********************
c2979beb635d/resourceGroups/OORT/providers/Microsoft.Network/virtualNetworks/OORT/provid
                        ers/Microsoft.Authorization/locks/oorttest
ResourceName          : OORT
ResourceType          : Microsoft.Network/virtualNetworks
ExtensionResourceName : oorttest
ExtensionResourceType : Microsoft.Authorization/locks
ResourceGroupName     : OORT
SubscriptionId        : ******************************
Properties            : @{level=ReadOnly; notes=}
LockId                : /subscriptions/3772683f-1d36-4b8b-940e-c2979beb635d/resourceGroups/OORT/providers/Microsoft.Network/virtualNetworks/OORT/provid
                        ers/Microsoft.Authorization/locks/oorttest



,
,
,
,
,
,
,
,
,
0
IT Pros Agree: AI and Machine Learning Key

We’d all like to think our company’s data is well protected, but when you ask IT professionals they admit the data probably is not as safe as it could be.

footechCommented:
I was doing a little research here.
If you have a lock on single resource, I don't think there's any property of the resource that reflects that.  The $rg.lock check might work if you locked the resource group, but I don't know.
From what I know, I would suggest just running Get-AzureRmResource to get all resources in a subscription, and comparing that with Get-AzureRmResourceLock.
Compare-Object -ReferenceObject (Get-AzureRmResource) -DifferenceObject (Get-AzureRmResourceLock) -Property ResourceName -Passthru | Select Name,ResourceType | Export-Csv unlocked.csv -notype

Open in new window

0
DBAduck - Ben MillerPrincipal ConsultantCommented:
My script may have been flawed. I left the Resource Group $rg.Lock in the mix, it should have been the resource.

Login-AzureRmAccount
select-azurermsubscription NameOfAzureSubHere
$rgs = Get-AzureRMResourceGroup
foreach ($rg in $rgs) {
     $Resources = Get-AzureRMResource
     foreach ($resource in $resources) { 
             if ($resource.Lock -eq $null) { 
                  "$($resource.Name), $($resource.ResourceType)" | Add-Content C:\Temp\unlocked.txt 
             } 
      }
} 
# get-azurermresourcelock | out-file -FilePath C:\Temp\unlocked.txt

Open in new window

0
Jay ThomasAuthor Commented:
Thank you both. I'll try these tomorrow. Appreciate your time.
0
Jay ThomasAuthor Commented:
Hi both. Tested both options this morning, both produce the same result, they include all resources despite whether a lock is applied or not. I tested this by running the script, producing the results and then locked additional resources these new locked resources still get displayed in the result.

I think footech is right, perhaps there is not property type to lock onto for the script to run. The only think that may suggest other, if I run this: get-azurermresourcelock | out-file -FilePath C:\Temp\unlocked3.txt   It produces the only 2 resources with a lock. And if you look at the output below, there is a property called "LockID" shouldn't we be able to use this in our search?


Name                  : MySub
ResourceId            : /subscriptions/*************************-c2979beb635d/resourceGroups/OORT/providers/Microsoft.Network/virtualNetworks/MySub/providers/Microsoft.Authorization/locks/MySub
ResourceName          : OORT
ResourceType          : Microsoft.Network/virtualNetworks
ExtensionResourceName : oorttest
ExtensionResourceType : Microsoft.Authorization/locks
ResourceGroupName     : OORT
SubscriptionId        : ****************************
Properties            : @{level=ReadOnly; notes=}
LockId                : /subscr****************************
resourceGroups/OORT/providers/Microsoft.Network/virtualNetworks/OORT/providers/Microsoft.Authorization/locks/MySub

Thanks both for looking.
0
DBAduck - Ben MillerPrincipal ConsultantCommented:
What about using the ResourceName in the loop?

Login-AzureRmAccount
select-azurermsubscription NameOfAzureSubHere
$rgs = Get-AzureRMResourceGroup
foreach ($rg in $rgs) {
     $Resources = Get-AzureRMResource
     foreach ($resource in $resources) { 
             if ( (Get-AzureRMResourceLock -ResourceName $resource.Name) -eq $null) { 
                  "$($resource.Name), $($resource.ResourceType)" | Add-Content C:\Temp\unlocked.txt 
             } 
      }
} 

Open in new window

0
footechCommented:
I tested my code when I had placed a lock on one Azure VM and it correctly listed every other resource except that one.  So I'm wondering why it wouldn't work for you.
In the same way the following should just show the resources with a lock on them.
Compare-Object -ReferenceObject (Get-AzureRmResource) -DifferenceObject (Get-AzureRmResourceLock) -Property ResourceName -IncludeEqual -ExcludeDifferent

Open in new window


Although LockId is a property returned by Get-AzureRmResourceLock, it is not returned by Get-AzureRmResource.  And Get-AzureRmResourceLock doesn't return resources that don't have a lock.

I see some basic problems with Ben's code.  $Resources will be the same each time through the loop.  Get-AzureRMResource gets all resources within a subscription.  Even if you tried to use $rg with Get-AzureRMResource, you can't really limit it to just return resources within a resource group, so you can omit the whole foreach ($rg in $rgs) loop.  If you really needed to return info about resources within a specific resource group, you could use Find-AzureRMResource.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Jay ThomasAuthor Commented:
Oh! I just retried both snippets and as you say footech, it appears to work :) Let me re-test, make sure i haven't missed anything.
0
Jay ThomasAuthor Commented:
Thanks so much and sorry for the late feedback I've been away. Those 2 lines of code worked great for what I was after.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Powershell

From novice to tech pro — start learning today.