Checking for the existence of an AD object; how do I avoid an ugly error message?

Question

I have a bit of code that looks like this:

if (Get-ADUser $DN -EA SilentlyContinue) {
  # Exists
} else {
  # Doesn't Exist
}

Unfortunately, when Get-ADUser the DN fails to find a user (which is fine, it means the object name is not taken), it throws up and spits out an error. I know it will fail, that's fine, which is why I have an -ErrorAction to SilentlyContinue. Unfortunately it seems to do nothing... I still get barf on the script output. The code works, it's just ugly due to the console spitting out the error.

Is there a better way for me to test whether a particular object exists?
If not, is there a way to get the ErrorAction to properly be silent?

`get-aduser -erroraction 'silentlycontinue'` seems to work properly in powershell-v4.0. — user2609980, Dec 30 '15 at 17:48
@user2609980 I don't know about Powershell 4.0 but nobody uses that version anymore anyways, and `get-aduser -erroraction 'silentlycontinue'` definitely throws an error to the shell both in Powershell v5 and v7. — adamency, Sep 05 '22 at 14:08

score 22 · Answer 1 · answered Jul 23 '12 at 07:04

22

The only way I have found to be working without spitting an error is with the filter parameter:

if (Get-ADUser -Filter {distinguishedName -eq $DN} ) {
  # Exists
} else {
  # Doesn't Exist
}

answered Jul 23 '12 at 07:04

Shay Levy

121,444
32
184
206

How do I get `-Properties *` and still get rid of these errors? – Kellen Stuart Apr 11 '17 at 17:19

score 15 · Accepted Answer · edited Nov 18 '19 at 10:46

You want to catch the exception of the object not being found, but you still want to fail for other reasons like access denied and such, so you need to specify the exact exception to catch.

Try
{
  Get-ADUser $DN -ErrorAction Stop
  # Do stuff if found
}
Catch [Microsoft.ActiveDirectory.Management.ADIdentityNotFoundException]
{ 
  # Do stuff if not found
}

To determine the exception type to catch in other use cases, cause an exception and then do:

$Error[0].Exception.GetType().FullName

The output of that goes into: catch [insert exception type here]

score 12 · Answer 3 · answered Jul 23 '12 at 03:46

12

It's an exception, you can just try to catch it like this :

$user = $(try {Get-ADUser $DN} catch {$null})
if ($user -ne $null) {
  # Exists
} else {
  # Doesn't Exist
}

answered Jul 23 '12 at 03:46

JPBlanc

70,406
17
130
175

score 3 · Answer 4 · answered Jul 23 '12 at 03:42

3

It appears this command is emitting a terminating error. Use a try { ... } catch { ... } to handle/suppress the error.

answered Jul 23 '12 at 03:42

Keith Hill

194,368
42
353
369

score 1 · Answer 5 · answered Jun 10 '21 at 20:09

I like to use the filter parameter because it returns null instead of throwing an exception if the user does not exist.

Example:

$user = Get-ADUser -Filter "SamAccountName -eq '$username'"

if ($user -eq $null)
{
    #User does not exist
}
else
{
    #User exists
}

score 0 · Answer 6 · answered Jul 23 '12 at 06:55

0

I would do this like this:

Get-ADUser | ?{$_.id -eq $DN.id}

Id or some other unique identifier.

This will return the user or null and will wrap the exception.

answered Jul 23 '12 at 06:55

Dmitry Alexandrov

640
5
23

5

That works, but it's hideously slow if you have even a moderately sized AD. Fetching every object, then filtering is not practical. – Myrddin Emrys Jul 23 '12 at 09:27
Yes, this is for smaller set of iterables. Actually it is the same as Shay Levy's but single line. – Dmitry Alexandrov Jul 23 '12 at 09:29
2

Are you sure of that? I was under the impression that -Filter was passed directly in as an LDAP query, to prevent thousands of results needing to be returned by the server. – Myrddin Emrys Jul 23 '12 at 15:53

Checking for the existence of an AD object; how do I avoid an ugly error message?

6 Answers6

Linked