AD user script to populate the IPPHONE attribute with the last 4 digits of the Telephonenumber attribute

Question

Good Afternoon Scripting Guys. I have a script that I have been working with pretty much all day today and just cant quite get it to play nice. Our objective is to search AD for specific users (say filtering them out with a username that starts with a "T")
and User account is "Enabled" then grab the last four digits of their phone number (phone number is set up as follows: (800) 123 456 ) then populate the IPPHONE attribute with the last four digits of their phone number. I have read a ton of online
blogs with users successfully making this happen but it appears that they are all using Quest (as the commands are all Get-qaduser and Set-qaduser). I need something that runs strictly in native Active Directory Module PowerShell on a Windows Server 2008r2
Domain Controller.  I am also trying to keep it as simple as possible by using a Get command, then piping a Set command.  I have saved the script into a .ps1 file with the logic as follows:
$SelUsers = Get-ADUser -filter {(SamAccountName -like "t*")} -Properties ipphone,telephonenumber -searchbase "OU=Test Users,OU=Temporary Org,OU=Test_Domain Users,DC=mydomain,DC=com" | where {($_.enabled -eq $True)}
foreach ($user in $SelUsers)
 {$user.ipphone = $user.telephonenumber(4,$User.telephonenumber.length-4)
 set-aduser -instance $user}
What is happening is kind of funny, but aggravating at the same time.  When we run the script, it completes with no errors.  When I pull up the properties of a user in the OU, the IP Phone field is populated with the number 8.  If the User
account did not have a telephone number, the IP Phone field is populated with a -4.  So, apparently, the script is somehow subtracting the "-4" from the number of all of the Telephone Number field's characters.  Basically 12-4 is 8. 
If there is no telephone number, then 0-4 is -4.  I have run the Get-ADUser portion of the script independently so I know its getting the correct users.  I also know it is populating the IPPHONE attribute but not with the last 4 digits of the telephone
number.  Can you guys help out and maybe get this to work correctly?  Also, can you add logic to it to the script to delete any value in the IPPHONE field first, then replace it with the last 4 digits of the telephone.
Any help would be GREATLY appreciated!!!!!  Thanks Guys...
Lee

Answer 1

First thing I would do is modify your filtering. This will remove the unneeded piping to the Where-Object cmdlet and also allow us to only return users who already have something in the telephoneNumber field. It is possible this could return all of your
users, but if you have service accounts, etc. that do not have a telephoneNumber then they will not be included in your results. It's just a little cleaner.
$SelUsers = Get-ADUser -filter {(SamAccountName -like 't*' -and Enabled -eq $True -and TelephoneNumber -like '*')}
I suspect you may have a made a mistake when you entered what your phone numbers looks like. I assume that you forgot a final digit. If this is correct, and you have a space in the phone number between the three digits and the final four then you can use
the split method to grab the last four digits.
Foreach ($User in $SelUsers) {
$Number = $User.telephoneNumber.split(' ')[-1]
Set-ADUser -Identity $User -Replace @{ipPhone=$Number}
There's no reason to delete what's in the field first because that's part of what the -Replace parameter will do anyway. This should help get you started!