Get-ADUser : The server has returned the following error: invalid enumeration context.

Question

I'm running a powershell command to add the email (AD mail) attribute to users in a specific OU.  It seems to work then will bomb out with the error in the title.
I'm using a "scripting guy" command that I've altered with my specfic OU/domain information however, I'm pasting in the more "generic" version :: Get-ADUser -LDAPFilter "(!(mail=\.name*))" -resultSetSize $null -searchbase "ou=test,dc=nwtraders,dc=com"|
% {set-aduser -identity $_.distinguishedname -email ($_.samaccountname + "@nwtraders.com")}
I work for a school district and this command is being used to add the mail attribute to the student's accounts.  I think about 2/3 of the students are completed but the script/command bombs and I'm not sure where or why.  I've resubmitted the
command several times but I'm not sure whether it's starting from where it bombed or if it's starting again at the beginning and essentially re-doing the ones already completed.
Can someone point me in the direction of a work around or a resolution to the Get-ADUser error?
Thanks!!

Answer 1

I don't know the error, so I can only guess there. But the LDAP syntax filter cannot be correct. Can you provide a link to the reference where "Scripting Guy" suggested this?
As written, you are retrieving all users where the mail attribute does not begin with the string ".name" (case insensitve), where "name" is not a property or attribute, but a string value. LDAP syntax clauses are in the format:
(<attributeName><operator><value>)
In your case, <operator> is "=", <attributeName> is "mail", and <value> is ".name". The "\" character is the escape character, which means to interpret the following character (the period in
this case) literally. You cannot use an attribute name on the right side of the operator (the "="), unless PowerShell has introduced some functionality I am not familiar with to expand the LDAP syntax. For example, the following does not filter
on users where the first name is the same as the last name:
(givenName=\.sn)
Instead, it filters on users where the first name is the string ".sn". Even if "\.name" was interpreted by the Get-ADUser cmdlet to be the "Name" attribute of the user, this would cause problems. "Name" is the
Relative Distinguished Name of the user (the value of the cn attribute) and it could include commas or spaces. I would expect "\.sAMAccountName" to make more sense.
Richard Mueller - MVP Directory Services