I used to be scrolling X (aka Twitter) as we speak and noticed this weblog put up, PowerShell: Report On-Premises Energetic Listing Accounts which are Synchronized with Azure AD Join, by Kevin Trent. I like studying weblog posts as I are inclined to be taught some new issues and see how folks have a tendency to unravel their issues. Upon studying the supplied code, two issues stood out to me:
- utilization of the AzureAD module, which goes to cease engaged on March 2024 (if Microsoft will not change it once more)
- utilizing Get-AzureADUser contained in the Choose-Object assertion
This is what that answer appears like:
Import-Module ActiveDirectory
Join-AzureAD
Get-ADUser -Filter {Enabled -EQ $True} -Properties * |
Choose-Object DisplayName, SamAccountName, UserPrincipalName, LastLogonDate,
@{N="AzureADSynced"; E=
Choose-Object -Property DirSyncEnabled).DirsyncEnabled} |
Export-Csv $env:userprofiledocumentsOn-Prem_CloudSynced_Accounts.csv
Whereas this answer will work for the subsequent couple of months and may match for 200 customers, Kevin talked about it could have problem querying 1000, 10000, or 50000 customers. It is going to both take hours to complete or by no means end in any respect. Except for the apparent that for every consumer, a name will must be made to Azure AD to get only one property, Energetic Listing would not like a pipeline. It might work very effectively more often than not, however as quickly as one thing runs longer, it’s going to begin throwing errors.
It is not going to occur each time, possibly even by no means, but when it’s going to, you’ll spend hours debugging what’s incorrect and the way to repair it. When working with the ActiveDirectory module, I wasted a lot of time lastly dropping the pipeline altogether.
