99 Problems and Well, You Know the Rest

So the previous script was the first full-fledged script that I wrote in Powershell. It shows, huh? There's probably a better way to do it, but hey, shut up. I have almost zero shell script, programming, batch file, human anatomy, and civil war knowledge, so let's just say I'm starting on the ground floor. Or the basement. Of a building 4 blocks away from the one I want to be in.

Here's the problems that I ran into while trying to write this. Maybe his will keep you from jumping off a bridge because you can't figure out how to script your way out of a directory called "Paper Sack". Maybe not, but if you're going to be a bad admin, you should remember that no matter what, someone out there is worse than you. Scary, right?!?

The first problem I ran into was turning the results of a query into something that I could use for if/else logic. I'd run something like:

get-qaduser worstadminever | select samaccountname

and get something back like:

SamAccountName
--------------
WorstAdminEver

If I tried to compare that to a known value it would never match, because of the column heading. I needed a way to return just the value, not the header row. Now, all of you know how to do this already, so maybe I shouldn't bother, but I don't care. When you declare the variable like:

$DumbUser = get-qaduser worstadminever | select samaccountname

All you have to do is follow it up with a re-declaration like so:

$DumbUser = $DumbUser.SamAccountName

This clears out all the column heading crap and gives you everything you want (besides an increase in pay). After that, it's easy to match the results of a query to known values, count the length of the string, etc.

Being able to perform this logic allowed me to check the query to see if a user account was returned. Not everyone in our HR system has an AD account, so I have to assume that I'm going to be making some queries that return with zero information. After checking to see if a user name was returned, I proceeded to look up the values the account had for extensionattribute1 and 2. If the fields don't need to be updated, then don't update them, you spaz. Sometimes it's handy to see when an account has been last modified, and if your moronic script hits everyone every day, you lose.

The last thing I did was to speed up the script by having get-qaduser only give me back the fields I want with the arguments:

-dontusedefaultincludedproperties -includedproperties extensionattribute1,extensionattribute2

You've got to hand it to Quest, you know what those arguments are doing. It's verbose, but it's better than anything you'll ever do.

All in all, these modifications dropped my runtime to about 2 hours.