2

In the below script either the -live or -test parameters should be required. However, the script will run without either switch. If I use one of those parameters I get the below error. Why is it not requiring either -live or -test and why is it failing if I use one of them?

C:\Users\Administrator\Documents\Disable-ADAccounts.ps1 : Parameter set cannot be resolved using the specified named parameters. At line:1 char:1 + . .\Disable-ADAccounts.ps1 -days 7 -all -live + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidArgument: (:) [Disable-ADAccounts.ps1], ParameterBindingException + FullyQualifiedErrorId : AmbiguousParameterSet,Disable-ADAccounts.ps1

    [CmdletBinding()]
    param (
    [Parameter(Mandatory = $true, ParameterSetName = 'UsersOnly')]
    [Switch]
    $usersOnly,

    [Parameter(Mandatory = $true, ParameterSetName = 'ComputersOnly')]
    [Switch]
    $computersOnly,

    [Parameter(Mandatory = $true, ParameterSetName = 'All')]
    [Switch]
    $all,

    [Parameter(Mandatory=$true)]
    [string]
    $days,

    [switch]
    $console,

    [Parameter(Mandatory = $true, ParameterSetName = 'Test')]
    [switch]
    $test,

    [Parameter(Mandatory = $true, ParameterSetName = 'Live')]
    [switch]
    $live
)

Process {
    $DC = Get-ADDomainController
    $OUs = Get-ADOrganizationalUnit -Filter * # Uncomment this line to search ALL OUs.  Comment Next Variable.
    #$OUs = Get-ADOrganizationalUnit -Filter 'Name -eq "test"' # Use this line to test on a single OU
    $TimeStamp = get-date -format D
    $description = "Disabled on " + $TimeStamp
    $noDisableComputer =  Get-ADGroupMember -Identity DoNotDisableComputers -Recursive | Select -ExpandProperty Name
    $noDisableUser =  Get-ADGroupMember -Identity DoNotDisableUsers -Recursive | Select -ExpandProperty Name
    $noDisable = $noDisableComputer+$noDisableUser
    $CurrentDate = Get-Date
    $CurrentDate = $CurrentDate.ToString('yyMMdd_hhmmss')
    $tempDir = [System.Environment]::GetEnvironmentVariable('TEMP','Machine')
    $logFile = $tempDir + "\DisabledAccounts_$CurrentDate.csv"

    # If -test switch is used enable -WhatIf parameter.
    If($test) { $whatIf = @{ WhatIf = $true } }
    ElseIf($live) { $whatIf = @{ WhatIf = $false } }

    # Set parameter to UsersOnly, ComputersOnly, or do not use a perameter
    If($usersOnly) { $scope = @{ UsersOnly = $true } }
    ElseIf($computersOnly) { $scope = @{ ComputersOnly =$true } }
    ElseIf($all) { $scope = @{} }

    # Disable User and/or Computer Objects inactive for XX days.

    # Iterate through Organizational Units
    foreach ($OU in $OUs) {

        # Search for User and/or Computer Objects inactive for XX days.  Disable object if not in DoNotDisable Security Groups
        $days = $days + "D"
        $accounts = Search-ADAccount -SearchBase $OU.DistinguishedName -SearchScope OneLevel -AccountInactive -TimeSpan ([timespan]7D) @scope
        foreach($account in $accounts){
            If ($noDisable -notcontains $account.Name) {
                Write-Host $account
        #        #Disable-ADAccount -Identity $account.DistinguishedName -Verbose $whatIf | Export-Csv $logFile
           }
        }
    }
}    

        # Move Disabled Users to Disabled Users OU & Add Timestamp to Description
        #Search-ADAccount –AccountDisabled –ComputersOnly –SearchBase $OU.DistinguishedName | Foreach-object {
            #Set-ADComputer $_ -Description $description -Verbose -WhatIf
            #Move-ADObject $_ –TargetPath “OU=Disabled Computers, DC=COH,DC=net” -Verbose -WhatIf
        #}
    #}
2
  • 1
    The -Live and -All parameters belong to two different parameter sets Commented Feb 19, 2020 at 17:29
  • 1
    I think you have mistakenly assumed that you have two groups of parameter sets because you grouped them separately. In actuality, you have 5 distinct parameter sets, and only one of the 5 can be active at any time. See my answer below. Commented Feb 19, 2020 at 17:37

1 Answer 1

5

I think you have confused yourself about parameter sets. What you have done is created five distinct parameter sets, and only one of those five can be active at any time. If I read your intent correctly, what you need is the ability to do any of the following:

 \Disable-ADAccounts.ps1 -days 7 -all -live
 \Disable-ADAccounts.ps1 -days 7 -UsersOnly -live
 \Disable-ADAccounts.ps1 -days 7 -ComputersOnly -live
 \Disable-ADAccounts.ps1 -days 7 -all -test
 \Disable-ADAccounts.ps1 -days 7 -UsersOnly -test
 \Disable-ADAccounts.ps1 -days 7 -ComputersOnly -test

If that is the case, you need six different parameter groups, not five. Each of your parameters should be a member of the groups it is needed in, so something like this:

[Parameter(Mandatory = $true, ParameterSetName = 'UsersOnlyLive')]
[Parameter(Mandatory = $true, ParameterSetName = 'UsersOnlyTest')]
[Switch]
$usersOnly,

[Parameter(Mandatory = $true, ParameterSetName = 'ComputersOnlyLive')]
[Parameter(Mandatory = $true, ParameterSetName = 'ComputersOnlyTest')]
[Switch]
$computersOnly,

[Parameter(Mandatory = $true, ParameterSetName = 'AllLive')]
[Parameter(Mandatory = $true, ParameterSetName = 'AllTest')]
[Switch]
$all,

[Parameter(Mandatory=$true)]
[string]
$days,

[switch]
$console,

[Parameter(Mandatory = $true, ParameterSetName = 'AllTest')]
[Parameter(Mandatory = $true, ParameterSetName = 'UsersOnlyTest')]
[Parameter(Mandatory = $true, ParameterSetName = 'ComputersOnlyTest')]
[switch]
$test,

[Parameter(Mandatory = $true, ParameterSetName = 'AllLive')]
[Parameter(Mandatory = $true, ParameterSetName = 'UsersOnlyLive')]
[Parameter(Mandatory = $true, ParameterSetName = 'ComputersOnlyLive')]
[switch]
$live

See this Microsoft article for more information about Parameter Sets.

I hope this helps.

Sign up to request clarification or add additional context in comments.

Comments

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.