In the below script either the -live or -test parameters should be required. However, the script will run without either switch. If I use one of those parameters I get the below error. Why is it not requiring either -live or -test and why is it failing if I use one of them?
C:\Users\Administrator\Documents\Disable-ADAccounts.ps1 : Parameter set cannot be resolved using the specified named parameters. At line:1 char:1 + . .\Disable-ADAccounts.ps1 -days 7 -all -live + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidArgument: (:) [Disable-ADAccounts.ps1], ParameterBindingException + FullyQualifiedErrorId : AmbiguousParameterSet,Disable-ADAccounts.ps1
[CmdletBinding()]
param (
[Parameter(Mandatory = $true, ParameterSetName = 'UsersOnly')]
[Switch]
$usersOnly,
[Parameter(Mandatory = $true, ParameterSetName = 'ComputersOnly')]
[Switch]
$computersOnly,
[Parameter(Mandatory = $true, ParameterSetName = 'All')]
[Switch]
$all,
[Parameter(Mandatory=$true)]
[string]
$days,
[switch]
$console,
[Parameter(Mandatory = $true, ParameterSetName = 'Test')]
[switch]
$test,
[Parameter(Mandatory = $true, ParameterSetName = 'Live')]
[switch]
$live
)
Process {
$DC = Get-ADDomainController
$OUs = Get-ADOrganizationalUnit -Filter * # Uncomment this line to search ALL OUs. Comment Next Variable.
#$OUs = Get-ADOrganizationalUnit -Filter 'Name -eq "test"' # Use this line to test on a single OU
$TimeStamp = get-date -format D
$description = "Disabled on " + $TimeStamp
$noDisableComputer = Get-ADGroupMember -Identity DoNotDisableComputers -Recursive | Select -ExpandProperty Name
$noDisableUser = Get-ADGroupMember -Identity DoNotDisableUsers -Recursive | Select -ExpandProperty Name
$noDisable = $noDisableComputer+$noDisableUser
$CurrentDate = Get-Date
$CurrentDate = $CurrentDate.ToString('yyMMdd_hhmmss')
$tempDir = [System.Environment]::GetEnvironmentVariable('TEMP','Machine')
$logFile = $tempDir + "\DisabledAccounts_$CurrentDate.csv"
# If -test switch is used enable -WhatIf parameter.
If($test) { $whatIf = @{ WhatIf = $true } }
ElseIf($live) { $whatIf = @{ WhatIf = $false } }
# Set parameter to UsersOnly, ComputersOnly, or do not use a perameter
If($usersOnly) { $scope = @{ UsersOnly = $true } }
ElseIf($computersOnly) { $scope = @{ ComputersOnly =$true } }
ElseIf($all) { $scope = @{} }
# Disable User and/or Computer Objects inactive for XX days.
# Iterate through Organizational Units
foreach ($OU in $OUs) {
# Search for User and/or Computer Objects inactive for XX days. Disable object if not in DoNotDisable Security Groups
$days = $days + "D"
$accounts = Search-ADAccount -SearchBase $OU.DistinguishedName -SearchScope OneLevel -AccountInactive -TimeSpan ([timespan]7D) @scope
foreach($account in $accounts){
If ($noDisable -notcontains $account.Name) {
Write-Host $account
# #Disable-ADAccount -Identity $account.DistinguishedName -Verbose $whatIf | Export-Csv $logFile
}
}
}
}
# Move Disabled Users to Disabled Users OU & Add Timestamp to Description
#Search-ADAccount –AccountDisabled –ComputersOnly –SearchBase $OU.DistinguishedName | Foreach-object {
#Set-ADComputer $_ -Description $description -Verbose -WhatIf
#Move-ADObject $_ –TargetPath “OU=Disabled Computers, DC=COH,DC=net” -Verbose -WhatIf
#}
#}
-Liveand-Allparameters belong to two different parameter sets