2

This function should run on Windows Server 2003 and 2008 R2 Using the command line to execute it line by line is SUCCESSFULL! Execution by script fails.

function addUser2Group([string]$user,[string]$group)
{    
    $cname = gc env:computername
    $objUser = [ADSI]("WinNT://$user")
    $objGroup = [ADSI]("WinNT://$cname/$group,group")  
    $members = $objGroup.PSBase.Invoke('Members')
    $found = $false

    foreach($m in $members)
    {
        if($m.GetType().InvokeMember('Name', 'GetProperty', $null, $m, $null) -eq $user)
        {
            $found = $true
        }
    }

    if(-not $found)
    {
        $objGroup.PSBase.Invoke('Add',$objUser.PSBase.Path)
    }

    $members = $objGroup.PSBase.Invoke('Members')
    $found = $false
    foreach($m in $members)
    {
        if($m.GetType().InvokeMember('Name', 'GetProperty', $null, $m, $null) -eq $user)
        {
            $found = $true
        }
    }

    return $found
}

addUser2Group('MyGlobalMonitoringUser',"SomeDBGroup")

It should add a user to a local group. But it only gives me the following error:

Exception calling "Invoke" with "2" argument(s): "Unknown error (0x80005000)"
+     $members = @($objGroup.PSBase.Invoke <<<< ("Members"))
+ CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
+ FullyQualifiedErrorId : DotNetMethodException





Edit: the error message that occurs with /add is

The following exception occurred while retrieving member "Add": "Unknown error (0x80005000)"


Code is:

function addUser2Group([string]$user,[string]$group)
{
    $cname = gc env:computername
    try
    {
        ([adsi]"WinNT://$cname/$group,group").Add("WinNT://$cname/$user,user")
    }
    catch
    {
        write2log($_)
        return $false
    }

    return $true
}
4
  • 1
    Are you running your script with admin rights? Dec 18, 2012 at 10:27
  • I run it from CMD.exe with admin rights (because I always have to unrestrict and re-restrict Powershell scripts)
    – Maru
    Dec 18, 2012 at 10:34
  • How are you calling it from cmd.exe? What is the exact command line you are using?
    – Goyuix
    Jan 11, 2013 at 16:35
  • POWERSHELL.EXE "& ""C:\Users\%USERNAME%\Desktop\servercheck.ps1"""
    – Maru
    Jan 15, 2013 at 8:14

5 Answers 5

14

Why go through the pain of reflection when PowerShell will do it for you? Example:

$group = [ADSI]"WinNT://./Power Users,group"
$group.Add("WinNT://SYSTEM,user")

The above adds the SYSTEM local account to the local Power Users group. I am not sure why you are getting the specific error above, you might get it with this abbreviated syntax as well. The particular COM interface that is being used is IADsGroup - reference here: http://msdn.microsoft.com/en-us/library/windows/desktop/aa706021.aspx

Note: Because you are actually consuming COM objects wrapped in .NET objects, it is a good idea to call the Dispose method on any ADSI objects that are created when you are finished with them.

1
  • Thanks for your help. I don't know, but somehow I could not find this easy solution. But I have already tried it (see other answer). It also fails in script, but works when executed from command line.
    – Maru
    Jan 11, 2013 at 8:35
2

Why wouldn't you use net localgroup /add in your script instead of all that nasty looking WMI? PowerShell is a shell, not an operating system :)

6
  • Nice idea, but not helpful. Why can I run this from command line, but not from a script? Because as I already said... it works! I'll try to use net local group + try..catch for now, but I still want an answer for this one :>
    – Maru
    Dec 20, 2012 at 10:04
  • net local group also fails. BtW: setting permissions with acl also fails. And yes, I am sure that I run it as admin!
    – Maru
    Dec 20, 2012 at 13:56
  • Sounds like you have a different problem (i.e. not powershell) then if "net localgroup" also fails. You need to reduce your script down to the smallest reproduction of the failure. Also, what version powershell are you running on each system? What versions fail? all? just one?
    – x0n
    Dec 20, 2012 at 13:59
  • running nothing but this command fails. A one-line script. I am running PS 2.0 on every server and the script fails on all. The Windows installations are identical (same image for all)
    – Maru
    Dec 20, 2012 at 14:15
  • Are you running this via powershell remoting or directly on the server through remote desktop? Also how exactly does net localgroup fail? What's the error message, exactly?
    – x0n
    Dec 20, 2012 at 17:11
1

Observations and assumptions

There are a couple of assumptions that are made based on the code.

  1. You only passed ONE parameter object with two values. Use the Param statement
  2. Call the function differently addUser2Group -user 'MyGlobalMonitoringUser' -group "SomeDBGroup"
  3. Validate the parameters passed. They should be checked for empty/null at least.
  4. This would only work if you had the $group variable assigned a value before the script ran.

Based on the fact that the incorrect parameter passing the value of the $group variable remains empty. It then caused the rest of the code to fail always returning the value of $False.


Proposed solution

Recommended Reading: Simplify your PowerShell Script with Parameter Validation

Include the Param "switch" in the function Change the way you call the function.

Here's a copy of the code that works.

function addUser2Group
{   
    # Added the Param Switch 
    Param(
        [string]$user,
        [string]$group
    )

    $cname = gc env:computername
    $objUser = [ADSI]("WinNT://$user")
    $objGroup = [ADSI]("WinNT://$cname/$group,group")
    #$members = $objGroup.Invoke('Members')
    $found = $false

    foreach($m in $members)
    {
        if($m.GetType().InvokeMember('Name', 'GetProperty', $null, $m, $null) -eq $user)
        {
            $found = $true
        }
    }

    if(-not $found)
    {
        $objGroup.PSBase.Invoke('Add',$objUser.PSBase.Path)
    }

    $members = $objGroup.PSBase.Invoke('Members')
    $found = $false
    foreach($m in $members)
    {
        if($m.GetType().InvokeMember('Name', 'GetProperty', $null, $m, $null) -eq $user)
        {
            $found = $true
        }
    }

    return $found
}

addUser2Group -user 'testing' -group "Administrators"
0

•0x80005000 ("The specified directory service attribute or value does not exist").

Parameter binding or Environmental culprit perhaps?

As for the issue with net localgroup: examine the error message carefully:

The following exception occurred while retrieving member "Add"

Evidentally the /add flag is not being properly set as it is being interpreted as a member name, but since no code is provided, can't say why.

1
  • sorry, I added the code. You could say it's just that one line so I did not think it was needed ;)
    – Maru
    Jan 11, 2013 at 8:38
0

Just to add a more uptodate approach roughly five years later:

$group = Get-LocalGroup SomeDBGroup
$user = Get-LocalUser MyGlobalMonitoringUser
Add-LocalGroupMember $group $user

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.