POWERSHELL - Change AD attribute (ScriptPath) for certain users.

[Koldov]

Quick background...

 

A long time ago in a galaxy....

 

Wait no, that's not right!

 

A long time before I started here they must have used Panda Antivirus and it changed a lot of the accounts in AD to have PAVLOG.BAT as the script path.

 

I have found them all with this (it lists everybody though):

 

$Users = Get-ADUser -Filter * -SearchBase "DC=mydomain,DC=com" -Properties DisplayName, scriptPath | out-file c:\data\ScriptPath.txt

 

Anyway, I now want to change them to have nothing in that attribute like all the other AD users.

 

I found this but it seemed like it would modify all the users (which might not be a bad thing as nobody uses a script) but I'd like to get it more targeted if possible... and I'm not sure if I have done the 'replace' bit correctly!

 

$Users = Get-ADUser -Filter * -SearchBase "DC=mydomain,DC=com" -Properties DisplayName, scriptPath
ForEach ($User in $Users) {
   $ScriptPath = $User.scriptPath -replace 'pavlog.bat',''
   Set-ADUser -Identity $User -ScriptPath $ScriptPath -WhatIf
}

[MartinByard]

Just quickly:

 

$Users = Get-ADUser -Filter * -SearchBase "DC=mydomain,DC=com" -Properties DisplayName, scriptPath
ForEach ($User in $Users) {
   if($User.scriptPath -like "*pavlog.bat*"){
       $ScriptPath = $User.scriptPath -replace 'pavlog.bat',''
       Set-ADUser -Identity $User -ScriptPath $ScriptPath -WhatIf
       }
}

 

It checks to see if pavlog.bat is in the scriptpath, before it runs the bit of code you already had to replace and set the new scriptpath.

 

Does that seem workable?

[Koldov]

Yes, that returns the right users and seems to say that it will "Set" on target... but errors out on actually changing the attribute...

 

So my part of the script doesn't work.

 

I just remove the -WhatIf is that right or do I replace it with a 'do it' command...?

Edited July 19, 2021 by Koldov

[MartinByard]

Just remove the -WhatIf bit, there is no 'do it' command

[Koldov]

Thanks @MartinByard

 

Finally fixed it!

 

It didn't really like the replace attribute being nothing ' ' so I tried it as 'null' and then with '' but it actually replaced it with '' instead of actually being NOT SET, I'm not actually sure if there's a difference but hey-ho...

 

Found a way to clear it, which actually returns it to being and not just saying :

 

$Users = Get-ADUser -Filter * -SearchBase "DC=my domain,DC=com" -Properties DisplayName, scriptPath
ForEach ($User in $Users) {
   if($User.scriptPath -like "**"){
       $ScriptPath = $User.scriptPath.clear
       Set-ADUser -Identity $User -ScriptPath $ScriptPath
       }
}

[DaveTheTech]

I woudl use the following two options for setting an attribute to null. The Clear switch can take a comma delimited list.

set-aduser $user -clear scriptPath or set-aduser $user -scriptpath $null