PowerShell Active Directory Objects Writable Properties

Question

I'm working on a script to synchronize two Active Directory forests (Production and QA, if you don't understand why, it doesn't matter, I need to do it). The problem I've run into is filtering properties to only writable and only those that are normally writable. From the MMC "Active Directory Users and Computers" I can look at the Attribute Editor tab and filter the attributes to "Show only writable attributes". This displays a completely different list than what I get viewing the same object with a PowerShell command.

I don't want to synchronize or attempt to modify attributes like nTSecurityDescriptor, ObjectClass, ObjectGUID, etc. I also don't want to try developing and maintaining a static list for each object class (OU, User, Group).

Is there a better way to retrieve the properties that are writable for a given AD object?

Here is an example of the problem with an OU object:

PS E:\Powershell> $ou | Get-Member | Where-Object {$_.Definition.Contains("set;")}

   TypeName: Microsoft.ActiveDirectory.Management.ADOrganizationalUnit

Name                            MemberType Definition
----                            ---------- ----------
City                            Property   System.String City {get;set;}
Country                         Property   System.String Country {get;set;}
Description                     Property   System.String Description {get;set;}
DisplayName                     Property   System.String DisplayName {get;set;}
DistinguishedName               Property   System.String DistinguishedName {get;set;}
l                               Property   System.String l {get;set;}
ManagedBy                       Property   System.String ManagedBy {get;set;}
nTSecurityDescriptor            Property   System.DirectoryServices.ActiveDirectorySecurity nTSecurityDescriptor {get...
ObjectClass                     Property   System.String ObjectClass {get;set;}
ObjectGUID                      Property   System.Nullable`1[[System.Guid, mscorlib, Version=4.0.0.0, Culture=neutral...
ou                              Property   Microsoft.ActiveDirectory.Management.ADPropertyValueCollection ou {get;set;}
PostalCode                      Property   System.String PostalCode {get;set;}
ProtectedFromAccidentalDeletion Property   System.Boolean ProtectedFromAccidentalDeletion {get;set;}
PSShowComputerName              Property   Microsoft.ActiveDirectory.Management.ADPropertyValueCollection PSShowCompu...
State                           Property   System.String State {get;set;}
StreetAddress                   Property   System.String StreetAddress {get;set;}
WriteDebugStream                Property   Microsoft.ActiveDirectory.Management.ADPropertyValueCollection WriteDebugS...
WriteErrorStream                Property   Microsoft.ActiveDirectory.Management.ADPropertyValueCollection WriteErrorS...
WriteInformationStream          Property   Microsoft.ActiveDirectory.Management.ADPropertyValueCollection WriteInform...
WriteVerboseStream              Property   Microsoft.ActiveDirectory.Management.ADPropertyValueCollection WriteVerbos...
WriteWarningStream              Property   Microsoft.ActiveDirectory.Management.ADPropertyValueCollection WriteWarnin...

Answer 1

To answer your first question, your example code, plus @tommymaynard's code essentially will give you a raw list of settable properties.

The "better" way to get the list of settable properties is to refer to the Set-ADUser documentation, which lists everything you can set and more importantly how to set them. Some properties need Hashtables and other parameters (-Add, -Clear, etc.) to set them properly.

Unfortunately, you will end up having 3 different lists for OU, User, and Groups simply because of the fact that they are 3 different object types, and they each have different properties and different cmdlets for setting properties.

If this sounds like a lot of manual work, and lists... yes it is. If the end goal is to synchronize between two domains, use Microsoft's Active Directory Migration Tool. It is designed to synchronize two different domains with one way sync, two way sync, password sync, SID history, etc. Way easier than doing it manually.

Answer 2

Try this...

Do yourself a favor and after you've run the below command once, remove the final Select-Object. After that, remove the Where-Object. Really take some time to understand what's happening here as you back yourself though these commands. You might even start at the beginning too and run just the Get-ADOrganizationalUnit command, then add the Select-Object, then add the ForEach-Object, etc. This should get you what you need.

PS> Get-ADOrganizationalUnit -Filter * -Properties * | Select-Object -First 1 | ForEach-Object {$_.psobject.properties} | Where-Object {$_.IsSettable -eq $true} | Select-Object -Property Name,IsSettable

Note: In my example, I only returned the first Organizational Unit. Keep that in mind if you move this into your own code.

Answer 3

For all that you are after, you'd want to use a different cmdlet with a slight twist on it.

For example:

(Get-ADOrganizationalUnit -Filter *)[0] |  Get-Member | Where-Object {$_.Definition.Contains("set;")} | Format-Table -AutoSize


   TypeName: Microsoft.ActiveDirectory.Management.ADOrganizationalUnit

Name              MemberType Definition                                                                                                                         
----              ---------- ----------                                                                                                                         
City              Property   System.String City {get;set;}                                                                                                      
Country           Property   System.String Country {get;set;}                                                                                                   
DistinguishedName Property   System.String DistinguishedName {get;set;}                                                                                         
ManagedBy         Property   System.String ManagedBy {get;set;}                                                                                                 
ObjectClass       Property   System.String ObjectClass {get;set;}                                                                                               
ObjectGUID        Property   System.Nullable`1[[System.Guid, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]] ObjectGUID {get;set;}
PostalCode        Property   System.String PostalCode {get;set;}                                                                                                
State             Property   System.String State {get;set;}                                                                                                     
StreetAddress     Property   System.String StreetAddress {get;set;} 

((Get-ADOrganizationalUnit -Filter *)[0] |  Get-Member | Where-Object {$_.Definition.Contains("set;")}).Count
 9


(Get-ADOrganizationalUnit -Filter * -Properties *)[0] |  Get-Member | Where-Object {$_.Definition.Contains("set;")} | Format-Table -AutoSize

   TypeName: Microsoft.ActiveDirectory.Management.ADOrganizationalUnit

Name                            MemberType Definition                                                                                                                 
----                            ---------- ----------                                                                                                                 
City                            Property   System.String City {get;set;}                                                                                              
Country                         Property   System.String Country {get;set;}                                                                                           
Description                     Property   System.String Description {get;set;}                                                                                       
DisplayName                     Property   System.String DisplayName {get;set;}                                                                                       
DistinguishedName               Property   System.String DistinguishedName {get;set;}                                                                                 
gPLink                          Property   System.String gPLink {get;set;}                                                                                            
isCriticalSystemObject          Property   System.Boolean isCriticalSystemObject {get;set;}                                                                           
ManagedBy                       Property   System.String ManagedBy {get;set;}                                                                                         
nTSecurityDescriptor            Property   System.DirectoryServices.ActiveDirectorySecurity nTSecurityDescriptor {get;set;}                                           
ObjectClass                     Property   System.String ObjectClass {get;set;}                                                                                       
ObjectGUID                      Property   System.Nullable`1[[System.Guid, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]] ObjectGUID...
ou                              Property   Microsoft.ActiveDirectory.Management.ADPropertyValueCollection ou {get;set;}                                               
PostalCode                      Property   System.String PostalCode {get;set;}                                                                                        
ProtectedFromAccidentalDeletion Property   System.Boolean ProtectedFromAccidentalDeletion {get;set;}                                                                  
showInAdvancedViewOnly          Property   System.Boolean showInAdvancedViewOnly {get;set;}                                                                           
State                           Property   System.String State {get;set;}                                                                                             
StreetAddress                   Property   System.String StreetAddress {get;set;} 

((Get-ADOrganizationalUnit -Filter * -Properties *)[0] |  Get-Member | Where-Object {$_.Definition.Contains("set;")}).Count

17

Playing with the AD: Drive for Fun and Profit

Push-Location -Path 'ad:\'
Get-ChildItem
Get-ChildItem -Path (Get-ADOrganizationalUnit -Filter *)[0] -Properties *

https://blogs.technet.microsoft.com/heyscriptingguy/2013/03/18/playing-with-the-ad-drive-for-fun-and-profit

Get-ChildItem -Path (Get-ADOrganizationalUnit -Filter *)[0] -Properties * | Get-Member | Format-Table -AutoSize
(Get-ChildItem -Path (Get-ADOrganizationalUnit -Filter *)[0] -Properties * | Get-Member | Format-Table -AutoSize).Count

62

   TypeName: Microsoft.ActiveDirectory.Management.ADObject

Name                          MemberType            Definition                                                                                                        
----                          ----------            ----------                                                                                                        
Contains                      Method                bool Contains(string propertyName)                                                                                
Equals                        Method                bool Equals(System.Object obj)                                                                                    
GetEnumerator                 Method                System.Collections.IDictionaryEnumerator GetEnumerator()                                                          
GetHashCode                   Method                int GetHashCode()                                                                                                 
GetType                       Method                type GetType()                                                                                                    
ToString                      Method                string ToString()                                                                                                 
PSChildName                   NoteProperty          System.String PSChildName=CN=SATLDC01                                                                             
PSDrive                       NoteProperty          Microsoft.ActiveDirectory.Management.Provider.ADDriveInfo PSDrive=AD                                              
PSIsContainer                 NoteProperty          System.Boolean PSIsContainer=True                                                                                 
PSParentPath                  NoteProperty          System.String PSParentPath=Microsoft.ActiveDirectory.Management\ActiveDirectory:://RootDSE/OU=Domain Controller...
PSPath                        NoteProperty          System.String PSPath=Microsoft.ActiveDirectory.Management\ActiveDirectory:://RootDSE/CN=SATLDC01,OU=Domain Cont...
PSProvider                    NoteProperty          System.Management.Automation.ProviderInfo PSProvider=Microsoft.ActiveDirectory.Management\ActiveDirectory         
Item                          ParameterizedProperty Microsoft.ActiveDirectory.Management.ADPropertyValueCollection Item(string propertyName) {get;}                   
accountExpires                Property              System.Int64 accountExpires {get;set;}                                                                            
AddedProperties               Property              System.Collections.Generic.ICollection[string] AddedProperties {get;}                                             
badPasswordTime               Property              System.Int64 badPasswordTime {get;set;}                                                                           
badPwdCount                   Property              System.Int32 badPwdCount {get;set;}                                                                               
cn                            Property              System.String cn {get;}                                                                                           
codePage                      Property              System.Int32 codePage {get;set;}                                                                                  
countryCode                   Property              System.Int32 countryCode {get;set;}                                                                               
distinguishedName             Property              System.String distinguishedName {get;set;}                                                                        
dNSHostName                   Property              System.String dNSHostName {get;set;}                                                                              
dSCorePropagationData         Property              Microsoft.ActiveDirectory.Management.ADPropertyValueCollection dSCorePropagationData {get;}                       
instanceType                  Property              System.Int32 instanceType {get;}                                                                                  
isCriticalSystemObject        Property              System.Boolean isCriticalSystemObject {get;set;}                                                                  
lastLogoff                    Property              System.Int64 lastLogoff {get;set;}                                                                                
lastLogon                     Property              System.Int64 lastLogon {get;set;}                                                                                 
lastLogonTimestamp            Property              System.Int64 lastLogonTimestamp {get;set;}                                                                        
localPolicyFlags              Property              System.Int32 localPolicyFlags {get;set;}                                                                          
logonCount                    Property              System.Int32 logonCount {get;set;}                                                                                
memberOf                      Property              Microsoft.ActiveDirectory.Management.ADPropertyValueCollection memberOf {get;}                                    
ModifiedProperties            Property              System.Collections.Generic.ICollection[string] ModifiedProperties {get;}                                          
msDFSR-ComputerReferenceBL    Property              Microsoft.ActiveDirectory.Management.ADPropertyValueCollection msDFSR-ComputerReferenceBL {get;}                  
msDS-SupportedEncryptionTypes Property              System.Int32 msDS-SupportedEncryptionTypes {get;set;}                                                             
name                          Property              System.String name {get;}                                                                                         
nTSecurityDescriptor          Property              System.DirectoryServices.ActiveDirectorySecurity nTSecurityDescriptor {get;set;}                                  
objectCategory                Property              System.String objectCategory {get;}                                                                               
objectClass                   Property              System.String objectClass {get;set;}                                                                              
objectGUID                    Property              System.Nullable`1[[System.Guid, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]] o...
objectSid                     Property              System.Security.Principal.SecurityIdentifier objectSid {get;}                                                     
operatingSystem               Property              System.String operatingSystem {get;set;}                                                                          
operatingSystemVersion        Property              System.String operatingSystemVersion {get;set;}                                                                   
primaryGroupID                Property              System.Int32 primaryGroupID {get;set;}                                                                            
PropertyCount                 Property              int PropertyCount {get;}                                                                                          
PropertyNames                 Property              System.Collections.ICollection PropertyNames {get;}                                                               
pwdLastSet                    Property              System.Int64 pwdLastSet {get;set;}                                                                                
RemovedProperties             Property              System.Collections.Generic.ICollection[string] RemovedProperties {get;}                                           
rIDSetReferences              Property              Microsoft.ActiveDirectory.Management.ADPropertyValueCollection rIDSetReferences {get;}                            
sAMAccountName                Property              System.String sAMAccountName {get;set;}                                                                           
sAMAccountType                Property              System.Int32 sAMAccountType {get;set;}                                                                            
serverReferenceBL             Property              Microsoft.ActiveDirectory.Management.ADPropertyValueCollection serverReferenceBL {get;}                           
servicePrincipalName          Property              Microsoft.ActiveDirectory.Management.ADPropertyValueCollection servicePrincipalName {get;set;}                    
userAccountControl            Property              System.Int32 userAccountControl {get;set;}                                                                        
userCertificate               Property              Microsoft.ActiveDirectory.Management.ADPropertyValueCollection userCertificate {get;set;}                         
uSNChanged                    Property              System.Int64 uSNChanged {get;}                                                                                    
uSNCreated                    Property              System.Int64 uSNCreated {get;}                                                                                    
whenChanged                   Property              System.DateTime whenChanged {get;}                                                                                
whenCreated                   Property              System.DateTime whenCreated {get;} 

Get-ChildItem -Path (Get-ADOrganizationalUnit -Filter *)[0] -Properties * | Get-Member | Where {$_.Definition.Contains("set;")} | Format-Table -AutoSize
(Get-ChildItem -Path (Get-ADOrganizationalUnit -Filter *)[0] -Properties * | Get-Member | Where {$_.Definition.Contains("set;")} | Format-Table -AutoSize).Count

30
   TypeName: Microsoft.ActiveDirectory.Management.ADObject

Name                          MemberType Definition                                                                                                                   
----                          ---------- ----------                                                                                                                   
accountExpires                Property   System.Int64 accountExpires {get;set;}                                                                                       
badPasswordTime               Property   System.Int64 badPasswordTime {get;set;}                                                                                      
badPwdCount                   Property   System.Int32 badPwdCount {get;set;}                                                                                          
codePage                      Property   System.Int32 codePage {get;set;}                                                                                             
countryCode                   Property   System.Int32 countryCode {get;set;}                                                                                          
distinguishedName             Property   System.String distinguishedName {get;set;}                                                                                   
dNSHostName                   Property   System.String dNSHostName {get;set;}                                                                                         
isCriticalSystemObject        Property   System.Boolean isCriticalSystemObject {get;set;}                                                                             
lastLogoff                    Property   System.Int64 lastLogoff {get;set;}                                                                                           
lastLogon                     Property   System.Int64 lastLogon {get;set;}                                                                                            
lastLogonTimestamp            Property   System.Int64 lastLogonTimestamp {get;set;}                                                                                   
localPolicyFlags              Property   System.Int32 localPolicyFlags {get;set;}                                                                                     
logonCount                    Property   System.Int32 logonCount {get;set;}                                                                                           
msDS-SupportedEncryptionTypes Property   System.Int32 msDS-SupportedEncryptionTypes {get;set;}                                                                        
nTSecurityDescriptor          Property   System.DirectoryServices.ActiveDirectorySecurity nTSecurityDescriptor {get;set;}                                             
objectClass                   Property   System.String objectClass {get;set;}                                                                                         
objectGUID                    Property   System.Nullable`1[[System.Guid, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]] objectGUID {...
operatingSystem               Property   System.String operatingSystem {get;set;}                                                                                     
operatingSystemVersion        Property   System.String operatingSystemVersion {get;set;}                                                                              
primaryGroupID                Property   System.Int32 primaryGroupID {get;set;}                                                                                       
pwdLastSet                    Property   System.Int64 pwdLastSet {get;set;}                                                                                           
sAMAccountName                Property   System.String sAMAccountName {get;set;}                                                                                      
sAMAccountType                Property   System.Int32 sAMAccountType {get;set;}                                                                                       
servicePrincipalName          Property   Microsoft.ActiveDirectory.Management.ADPropertyValueCollection servicePrincipalName {get;set;}                               
userAccountControl            Property   System.Int32 userAccountControl {get;set;}                                                                                   
userCertificate               Property   Microsoft.ActiveDirectory.Management.ADPropertyValueCollection userCertificate {get;set;}