Hiding Errors When Using Get-ADGroup

Question

I'm working on a script that will build a new group if it doesn't exist. I'm using Get-ADGroup to make sure the group doesn't exist using the following command:

$group = get-adgroup $groupName -ErrorAction:SilentlyContinue -WarningAction:SilentlyContinue 

But when I do I get the following error (I removed any domain specific data from the error):

Get-ADGroup : Cannot find an object with identity: '*group name*' under: '*domain*'.
At U:\Scripts\Windows\Create-FolderAccessGroup.ps1:23 char:24
+ $group = get-adgroup <<<< $groupName -ErrorAction:SilentlyContinue -WarningAction:SilentlyContinue
    + CategoryInfo          : ObjectNotFound: (y:ADGroup) [Get-ADGroup], ADIdentityNot
   FoundException
    + FullyQualifiedErrorId : Cannot find an object with identity: '' under: ''.,Microsoft.ActiveDirectory.Management.Commands.GetADGroup

I assumed setting ErrorAction and WarningAction to SilentlyContinue would keep this error from being displayed but it hasn't.

Meanly

I don't want to post this as an answer because I have no idea if it will work or not and I can't test it right now, but try piping it to Out-Null. – Kylix

@Kylix so $group = get-adgroup $groupName | out-null? – Meanly

That is what I would try, but as I say I'm not sure that it will work. – Kylix

Good thing I didn't put it as an answer then :) – Kylix

@Kylix - that is for output. For example if you do "blah" | out-null, the blah wont be passed to the pipeline ( or console) Nothing to do with errors / exceptions. – Mandibular

Answer 1

 try {get-adgroup <groupname>}
  catch  {
      <make new group>
     }

Cockatoo

Thanks for this, small note, if you don't want the output of get-adgroup dumped to the console, use $x = get-adgroup <groupname> – Birdman

You can also just redirect the output to $null, or pipe it to out-null. – Cockatoo

Answer 2

I find that this works best:

$Group = Get-ADGroup -Filter {SamAccountName -eq $GroupName}

If the filter returns no results, then $Group is simply set to $null and no error message is generated. Also, since a SAM account name must be unique in Active Directory, there is no risk of $Group being set to an array of more than one object.

I find that using -Filter to get the group rather than -Identity works really well when checking for the existence of groups (or users) in If statements. For example:

If (Get-ADGroup -Filter {SamAccountName -eq $GroupName})
{
    Add-ADGroupMember -Identity $GroupName -Members $ListOfUserSamAccountNames
}
Else
{
    Write-Warning "Users could not be added to $GroupName because $GroupName
    does not exist in Active Directory."
}

I find that is a lot easier to deal with logically (if the group exists, add the users; if not, display a message) than mjolinor's suggestion of try/catch with using the Get-ADGroup cmdlet with the -Identity parameter. Consider the try/catch method of doing the same as above, using the -Identity parameter:

Try
{
    Get-ADGroup -Identity $GroupName
    Add-ADGroupMember -Identity $GroupName -Members $ListOfUserSamAccountNames
}
Catch
{
    Write-Warning "Users could not be added to $GroupName because $GroupName
    does not exist in Active Directory."
}

You see if any of the commands in the try block throws a terminating error. If one does, it means the group doesn't exist and will move on and process the command(s) in the catch block. It will work, but I don't think try/catch here flows as well, logically, in comparison to if/else.

Don't get me wrong, mjolinor is a PowerShell genius. It's just that in this case I don't think his solution is the best one.

Canaliculus

I also prefer using -filter which makes for much cleaner code. I always see people using try/catch too frequently when they should be thinking of more elegant strategies like this one. – Shalom

Answer 3

@mjolinor gives the good answer, but I think some explanation can also help.

Windows PowerShell provides two mechanisms for reporting errors: one mechanism for terminating errors and another mechanism for non-terminating errors.

Internal CmdLets code can call a ThrowTerminatingError method when an error occurs that does not or should not allow the cmdlet to continue to process its input objects. The script writter can them use exception to catch these error.

Internal CmdLets code can call a WriteError method to report non-terminating errors when the cmdlet can continue processing the input objects. The script writer can then use -ErrorAction option to hide the messages.

Unbraid

Thanks, mjolinor has the technically correct answer and your explanation is very helpful. – Meanly

Answer 4

I realize this is old, but I also had this problem and solved it like this:

If (Get-ADObject -Filter {objectClass -eq "Group -and samAccountName -eq "groupname"}) { //do stuff// }

Tosch

Answer 5

try {New-ADGroup -Name "$NameGROUP -GroupScope Global -Path "$PathOU"} catch { }

Terpineol

As it’s currently written, your answer is unclear. Please edit to add additional details that will help others understand how this addresses the question asked. You can find more information on how to write good answers in the help center. – Empathic