CODEWITHSUNDEEP
windowspowershellactive-directory
LockTheTaskBar
LockTheTaskBar

Reputation: 109

Powershell CSV Import Error - The object name has bad syntax

Can't seem to figure out what is causing the error with script below with the "New-ADUser" syntax. Not sure if anybody can spot the error?

"New-ADUser : The object name has bad syntax

At D:\ScriptPath\importadusersAndMoveOU.ps1:33 char:3"

The script works if I remove the "$NewOU" variable and have the users imported into the default "users" OU. 

# Import active directory module for running AD cmdlets
Import-Module activedirectory

#Store the data from ADUsers.csv in the $ADUsers variable
$ADUsers = Import-csv 'D:\CSVPATH\adusers.csv'
$NewOU = New-ADOrganizationalUnit -Name "ADMINS"

#Loop through each row containing user details in the CSV file 
foreach ($User in $ADUsers)
{
    #Read user data from each field in each row and assign the data to a 
variable as below


$DomainName = Get-ADDomain -current LocalComputer
$Username   = $User.username
$Password   = "TestPassword12345"
$Firstname  = $User.firstname
$Lastname   = $User.lastname
$OU         = $NewOU+","+$DomainName.DistinguishedName
$upn = $Username+"@"+$DomainName.DNSRoot

#Check to see if the user already exists in AD
if (Get-ADUser -F {SamAccountName -eq $Username})
{
     #If user does exist, give a warning
     Write-Warning "A user account with username $Username already exist in Active Directory."
}
else
{
    #User does not exist then proceed to create the new user account

    #Account will be created in the OU provided by the $OU variable read from the CSV file
    New-ADUser `
        -SamAccountName $Username `
        -UserPrincipalName $upn `
        -Name "$Firstname $Lastname" `
        -GivenName $Firstname `
        -Surname $Lastname `
        -Enabled $True `
        -DisplayName "$Lastname, $Firstname" `
        -Path $OU `
        -AccountPassword (convertto-securestring $Password -AsPlainText -Force) -ChangePasswordAtLogon $True
    Add-ADGroupMember "domain admins" $username
    Add-ADGroupMember "enterprise admins" $Username
    }
}

Upvotes: 1

Views: 714

Answers (1)

Theo
Theo

Reputation: 61028

The New-ADOrganizationalUnit -Name "ADMINS" command creates a new OU under the default NC head for the domain. If you want that elsewhere, you should use the -Path <DistinghuisedName of Parent OU> parameter.

However, as Drew Lean already commented, this code does not check if the OU exists before trying to create it, so a quick test might be in order here:

[adsi]::Exists("LDAP://OU=ADMINS,DC=domain,DC=com")

or 

Get-ADOrganizationalUnit -Filter "distinguishedName -eq 'OU=ADMINS,DC=domain,DC=com'"
# don't filter on 'Name' because it is more than likely you have several OUs with the same name

Next, the part where you construct the distinguishedName for variable $OU results in a badly formatted string. $OU = $NewOU+","+$DomainName.DistinguishedName will result in "ADMINS,DC=domain,DC=com" which is not a valid DistinghuishedName, hence the error The object name has bad syntax

Try getting the DN of the existing OU first and if that does not exist, capture it after the creation and store the DistinghuishedName in variable $OU

something like this:

$OU = "OU=ADMINS,DC=domain,DC=com"
if (-not (Get-ADOrganizationalUnit -Filter "distinguishedName -eq '$OU'")) {
    $NewOU = New-ADOrganizationalUnit -Name "ADMINS" -PassThru
    $OU = $NewOU.DistinghuishedName
}

ps. The Identity parameter for Get-ADOrganizationalUnit must be one of:

  • A distinguished name
  • A GUID (objectGUID)
  • A security identifier (objectSid)
  • A Security Account Manager account name (sAMAccountName)

Upvotes: 2

Related Questions