Jorge's Quest For Knowledge!

About Windows Server, ADDS, ADFS, Azure AD, FIM/MIM & AADSync (Just Like An Addiction, The More You Have, The More You Want To Have!)

(2013-01-28) Fixing The ProxyAddresses Attribute In AD With PowerShell

Posted by Jorge on 2013-01-28


At a customer of mine (no names are or will be mentioned to protect the innocent!) I’m rebuilding their FIM GAL Sync solution. After running the Full Import (Stage Only) Run Profile I started the Full Synchronization Run Profile and during that Run Profile the FIM Sync Engine started to complain about incorrect/unexpected values in the proxyAddresses attribute of CONTACT objects in the target OU of a connected AD forest.

-

After investigating the data health I found out that just over 1700 contacts had a proxyAddress value as shown in the picture below

image

Figure 1: Contact Object With An Incorrect X500 Address

-

Because there were too many objects to do it by hand, creating a PowerShell script was the next step.

I required the following three PowerShell scripts:

  1. Export all the proxyAddresses values of the contacts objects with an X500 address as shown in the figure 1 (a safe measure)
  2. Remove the incorrect X500 address from the proxyAddresses values of the affected contact objects (the cleanup)
  3. Reimport all the proxyAddresses values prior to the removal of the incorrect X500 address (risk mitigating action)

-

[1]

Get-ADObject -SearchBase "OU=CONTACTS-PARTNER.LAN,OU=Org-Users,DC=ADCORP,DC=LAB" -LDAPFilter "(&(objectClass=contact)(proxyAddresses=X500:))" -Properties DistinguishedName,ObjectGUID,proxyaddresses | Select DistinguishedName,ObjectGUID,@{Name='proxyAddresses';Expression={[string]::join(";", $($_.proxyAddresses))}} | Export-Csv -Path .\ContactsWithBrokenX500Addresses.csv

-

[2]

Get-ADObject -SearchBase "OU=CONTACTS-PARTNER.LAN,OU=Org-Users,DC=ADCORP,DC=LAB" -LDAPFilter "(&(objectClass=contact)(proxyAddresses=X500:))" -Properties DistinguishedName,ObjectGUID,proxyaddresses | %{Set-ADObject -Identity $_.ObjectGUID -Remove @{proxyAddresses='X500:'}}

-

[3]

Import-Csv ContactsWithBrokenX500Addresses.csv | ForEach-Object{ $guid = $_.ObjectGUID $proxyAddresses = $_.proxyaddresses -split ';' Set-ADObject -Identity $guid -Replace @{proxyAddresses=$proxyAddresses} }

-

The most tricky part was getting all the values from the multi-valued proxyAddresses attribute and export that to a CSV file

-

Cheers,

Jorge

———————————————————————————————

* This posting is provided "AS IS" with no warranties and confers no rights!

* Always evaluate/test yourself before using/implementing this!

* DISCLAIMER: http://jorgequestforknowledge.wordpress.com/disclaimer/

———————————————————————————————

############### Jorge’s Quest For Knowledge #############

######### http://JorgeQuestForKnowledge.wordpress.com/ ########

———————————————————————————————

About these ads

4 Responses to “(2013-01-28) Fixing The ProxyAddresses Attribute In AD With PowerShell”

  1. [...] (2013-01-28) Fixing The ProxyAddresses Attribute In AD With PowerShell  [...]

  2. ismail said

    I am getting the following error :
    Set-ADOjbect : replace

    At Line:5 char:5

    + Set-Adobject -identiy $guid -Replace @{proxyaddresses=$proxyaddresses}

    + CategoryInfo : Invalidoperation : (b0036c7f-8248-4f4b-ada4-7622b6d3301b :ADObject [Set-Adobject], ADInvalidoperationexception

    + FullyQualifiedErrorId: replace,Microsoft.ActiveDirectory.Management.Commands.SetADobject

  3. Ismail said

    Hi,

    I am looking for this kind of script. I tried to execute the import command set-adobject however i am getting the following error

    Set-ADOjbect : replace

    At Line:5 char:5

    + Set-Adobject -identiy $guid -Replace @{proxyaddresses=$proxyaddresses}

    + CategoryInfo : Invalidoperation : (b0036c7f-8248-4f4b-ada4-7622b6d3301b :ADObject [Set-Adobject], ADInvalidoperationexception

    + FullyQualifiedErrorId: replace,Microsoft.ActiveDirectory.Management.Commands.SetADobject

  4. Mark Graff said

    You saved me a lot of effort. Thanks!

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

 
%d bloggers like this: