Scroll Top
Evotec Services sp. z o.o., ul. Drozdów 6, Mikołów, 43-190, Poland
+48 502 469 760
[email protected]

Get-ADObject : The server has returned the following error: invalid enumeration context.

Get-ADObject : The server has returned the following error: invalid enumeration context.
PowerShellBlack
By Przemyslaw Klys Active Directory PowerShell 15 maja, 2020

In the last weeks, I'm working on a PowerShell module that the main goal is to work on gathering and fixing GPOs. I've been testing my module a lot of times on my test environment, and it worked fine till the moment I run it on production, and it started to fail pretty quickly. The difference between my environment and production is 25 GPOs vs. 5000 GPOs. The error I was getting:

Get-ADObject : The server has returned the following error: invalid enumeration context.
At C:\Users\Administrator\Documents\WindowsPowerShell\Modules\GPOZaurr\0.0.26\GPOZaurr.psm1:1987 char:13
+ Get-ADObject @Splat -Properties DisplayName, Name, Create …
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [Get-ADObject], ADException
+ FullyQualifiedErrorId : The server has returned the following error: invalid enumeration context.,Microsoft.ActiveDirectory.Management.Commands.GetADObject

The error doesn't tell much but I've seen the error in multiple other situations mainly when using Get-ADUser, Get-ADComputer, or Get-ADGroup, but I'm confident that it touches all AD cmdlets. The errors would be very similar:

Get-ADUser: The server has returned the following error: invalid enumeration context.

Get-ADComputer: The server has returned the following error: invalid enumeration context.

Get-ADGroup: The server has returned the following error: invalid enumeration context.

The server has returned the following error: invalid enumeration context.

The issue comes from using ForEach-Object on AD cmdlets. While ForEach-Object is excellent and allows you to execute action over the pipeline as objects are read, it causes Get-ADObject to timeout if actions taken during pipeline are taking a too long time. A single query has a time limit. If you start a query on Get-ADObject that executes multiple operations on every object from the pipeline, the time adds up and the query timeouts.

Get-ADObject @Splat -Properties DisplayName, Name, Created, Modified, gPCFileSysPath, gPCFunctionalityVersion, gPCWQLFilter, gPCMachineExtensionNames, Description, CanonicalName, DistinguishedName | ForEach-Object -Process {
    $DomainCN = ConvertFrom-DistinguishedName -DistinguishedName $_.DistinguishedName -ToDomainCN
    $Output = [ordered]@{ }
    $Output['DisplayName'] = $_.DisplayName
    $Output['DomainName'] = $DomainCN
    $Output['Description'] = $_.Description
    $Output['GUID'] = $_.Name -replace '{' -replace '}'
    $Output['Path'] = $_.gPCFileSysPath
    $Output['FunctionalityVersion'] = $_.gPCFunctionalityVersion
    $Output['Created'] = $_.Created
    $Output['Modified'] = $_.Modified
    $Output['GPOCanonicalName'] = $_.CanonicalName
    $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_.DistinguishedName -ToDC
    $Output['GPODistinguishedName'] = $_.DistinguishedName
    [PSCustomObject] $Output
}

So while small query like above works great, because it's just doing some small conversion of an object – using it nested to another function with another ForEach-Object and checking for more values makes AD Cmdlets timeout. My original query looks like below

Get-GPOZaurrAD @getGPOZaurrADSplat | ForEach-Object -Process {
    Write-Verbose "Get-GPOZaurrOwner - Processing GPO: $($_.DisplayName) from domain: $($_.DomainName)"
    $ACL = Get-ADACLOwner -ADObject $_.GPODistinguishedName -Resolve -ADAdministrativeGroups $ADAdministrativeGroups
    $Object = [ordered] @{
        DisplayName       = $_.DisplayName
        DomainName        = $_.DomainName
        GUID              = $_.GUID
        DistinguishedName = $_.GPODistinguishedName
        Owner             = $ACL.OwnerName
        OwnerSid          = $ACL.OwnerSid
        OwnerType         = $ACL.OwnerType
    }
    if ($IncludeSysvol) {
        $FileOwner = Get-FileOwner -JustPath -Path $_.Path -Resolve
        $Object['SysvolOwner'] = $FileOwner.OwnerName
        $Object['SysvolSid'] = $FileOwner.OwnerSid
        $Object['SysvolType'] = $FileOwner.OwnerType
        $Object['SysvolPath'] = $_.Path
    }
    [PSCUstomObject] $Object
}

A Get-GPOZaurrAD function which is a wrapper around  Get-ADObject. It queries AD, and for each object returned, it checks the GPO Owner and SysVol Owner. This process taking about 1 second per each check, makes the connection to Active Directory timeout. Of course, during my tests on 25 GPOs, the timeout won't happen, but as you imagine querying 5000 AD objects, each taking 1 second it means a single Get-ADObject query would require around 83 minutes to finish.

Dealing with the problem

There are 2 ways to deal with this problem. The easiest ones are to simply save query first to variable and then either use ForEach-Object or foreach to gather results.

$Objects = Get-GPOZaurrAD @getGPOZaurrADSplat
$Objects | ForEach-Object -Process {
    Write-Verbose "Get-GPOZaurrOwner - Processing GPO: $($_.DisplayName) from domain: $($_.DomainName)"
    $ACL = Get-ADACLOwner -ADObject $_.GPODistinguishedName -Resolve -ADAdministrativeGroups $ADAdministrativeGroups
    $Object = [ordered] @{
        DisplayName       = $_.DisplayName
        DomainName        = $_.DomainName
        GUID              = $_.GUID
        DistinguishedName = $_.GPODistinguishedName
        Owner             = $ACL.OwnerName
        OwnerSid          = $ACL.OwnerSid
        OwnerType         = $ACL.OwnerType
    }
    if ($IncludeSysvol) {
        $FileOwner = Get-FileOwner -JustPath -Path $_.Path -Resolve
        $Object['SysvolOwner'] = $FileOwner.OwnerName
        $Object['SysvolSid'] = $FileOwner.OwnerSid
        $Object['SysvolType'] = $FileOwner.OwnerType
        $Object['SysvolPath'] = $_.Path
    }
    [PSCUstomObject] $Object
}

From my own testing if I am already saving data to variable I prefer the later

$Objects = Get-GPOZaurrAD @getGPOZaurrADSplat
foreach ($_ in $Objects) {
    Write-Verbose "Get-GPOZaurrOwner - Processing GPO: $($_.DisplayName) from domain: $($_.DomainName)"
    $ACL = Get-ADACLOwner -ADObject $_.GPODistinguishedName -Resolve -ADAdministrativeGroups $ADAdministrativeGroups
    $Object = [ordered] @{
        DisplayName       = $_.DisplayName
        DomainName        = $_.DomainName
        GUID              = $_.GUID
        DistinguishedName = $_.GPODistinguishedName
        Owner             = $ACL.OwnerName
        OwnerSid          = $ACL.OwnerSid
        OwnerType         = $ACL.OwnerType
    }
    if ($IncludeSysvol) {
        $FileOwner = Get-FileOwner -JustPath -Path $_.Path -Resolve
        $Object['SysvolOwner'] = $FileOwner.OwnerName
        $Object['SysvolSid'] = $FileOwner.OwnerSid
        $Object['SysvolType'] = $FileOwner.OwnerType
        $Object['SysvolPath'] = $_.Path
    }
    [PSCUstomObject] $Object
}

Alternatively, you can change Active Directory Web Services timeout to a higher value. The second option has two significant issues. One, you need to be in charge of your Active Directory environment, which may be hard enough in environments you would hit this issue. Also, your scripts would only work on AD that has higher values set, hitting errors as soon as you try to use it on similar scale environments that don't have adjusted timeout settings. Second, Microsoft discourages this change. You can read about it in the following article What's New in AD DS: Active Directory Web Services.

Changing the default value of this parameter is strongly discouraged. Most of the search results are returned within 30 minutes.

This means that a single call for Get-ADObject, Get-ADUser, Get-ADComputer (and so on) has to finish in 30 minutes or less. Using ForEach-Object, due to its nature, can impact the time it takes to deliver all records; therefore, you should use it with caution. Knowing this, I opted for the first approach – making sure I can use my scripts anywhere I want to.

Przemyslaw Klys / About Author
System Architect with over 14 years of experience in the IT field. Skilled, among others, in Active Directory, Microsoft Exchange and Office 365. Profoundly interested in PowerShell. Software geek.
More posts by Przemyslaw Klys

Posty powiązane

Office 365 – msExchHideFromAddressLists does not synchronize with Office 365
24 mar 2020
Statusimo
Meet Statusimo – PowerShell generated Status Page
A few weeks ago, Mateusz Czerniawski, mentioned that he wants to build a Status Page for his company services. While I haven’t needed for myself, it seems like an excellent idea to try and create one in PowerShell. Since I’ve been working on PSWriteHTML for a while, it wasn’t that far fetched idea. While PSWriteHTML has a long way to go, to be in a state I want it to be, after a few days I had a prototype that didn’t require much work to generate. If you’re wondering what Status Page is it’s a little summary page for your users to check what is the status of services they use. It has been popular in the last few years and is offered by many services (Twitter, GitHub, Office 365 – they all have it). Companies are selling it as a service as well where you can host your status page for your users. This one is free.
06 mar 2019
Renaming NETBIOS name of Active Directory Error
Recently I was testing renaming the NETBIOS name of an Active Directory domain. While this process is fairly easy, there are a few gotcha’s, and before one would like to rename their domain or NETBIOS name, serious testing is required to be sure everything works after rename. In the end, if something goes wrong, the rollback will not be a walk in a park. It will hurt, and it will eat your time. So there was I going thru the usual steps.
16 lut 2020
Import-Module: This script contains malicious content and has been blocked by your antivirus software.
Import-Module: This script contains malicious content and has been blocked by your antivirus software.
I’ve been working today on a little project when suddenly my modules stopped working. It was weird because I have not touched anything that could cause it. A message was a bit cryptic mentioning that my PSWriteColor module is required but not available. I’ve decided to try and load PSWriteColor manually using Import-Module command.
12 gru 2018
Testimo
Active Directory Domain Services could not replicate the directory partition – The replication operation encountered a database error
If you ever encounter an error while trying to create a new domain within a forest saying, “The replication operation encountered a database error,” it makes you sweat a bit. Your brain tells you it will be a nightmare to fix, do I have proper backups to make it happen, and the question “why now” shows up.
28 lis 2021
Invalid Class Error
Set-PSRepository Installation Policy Trusted – Invalid Class Error
I have to admit – executing the same command three times and expecting different results is dumb, but I still do it anyway. Fortunately, after trying three times I usually resort to other methods and try to solve the problem I have. Today while trying to trust PowerShellGallery I was greeted with an error.
21 lis 2019
Instant Replication between Active Directory sites with PowerShell
In Active Directory when you change something, it’s replicated to other Domain Controllers regularly. It’s a standard procedure that happens automatically in the background for you. It’s a handy feature because you can have multiple DC’s all over the world and have your users data in sync. You can change almost anything on DC nearest to you and be sure it will be the same value all over the place. But is it always the same? Well, it should be unless it isn’t. Today I was given a new migration from  Exchange to Office 365. I started with ADConnect installation and wanted to make sure that UserPrincipalNames have all UPNSuffixes in place.
21 lip 2019
MicrosoftE xchange
Microsoft Exchange – Connecting to remote server failed with the following error message
0
26 lis 2015
Sending HTML emails with PowerShell and zero HTML knowledge required
I saw this article by Altaro tweeted Building PowerShell Tools for MSPs: HTML Tables for Reporting, and it describes how you can create HTML emails with just a few lines of code. Luke created that article in 2018 (tweets from the archive I guess), but I just saw it now so thought I would make a slight comparison. In 2018 I would probably go the same way as shown by Luke Orellana, who takes a simple example of querying WMI to get disk drive sizes and send them over, formatted via Email.
11 lip 2019
Executing hidden or private functions from PowerShell Modules
When you write PowerShell modules, there’s a high chance you will have conflicts with either existing system commands (you should avoid that) or with someone else’s modules. There are also times when someone wants to use a private function from a module that only exports essential functions. Here’s a couple of ways how to deal with those scenarios.
14 lip 2019
Working with Windows Events with PowerShell
28 maj 2018
Office 365 - Inbox Rules
Office 365 – Find Users Forwarding Emails (PowerShell)
20 paź 2018
Invoke-RestMethod Error
Invoke-RestMethod : The underlying connection was closed: An unexpected error occurred on a send while connecting Graph API
In the last few days, I’ve got two reports that my PowerShell module for Office 365 Health suddenly started giving errors. This was a bit weird because it worked perfectly fine on my end. But while I could understand one person having an issue of their own, with their network or firewalls, if the second person comes along with the same report, that means something else is going on.
14 gru 2019
Sending as Alias in Office 365
Sending email as an alias (proxy address) with Office 365
Sending emails in Microsoft Exchange world using an alias for an account has always been a pain. It required working with workarounds such as setting up Shared Mailbox or Distribution Groups and using SendAs permissions. For years admins around the world were asking Microsoft to change this, and finally, in April 2021, they did! It’s a new feature of Office 365, and it requires action from Office 365 Administrator.
20 kwi 2021
Office 365 Health Service
PowerShell way to get all information about Office 365 Service Health
Office 365 is an excellent cloud service. But like any service, there’s some infrastructure behind it that has to be cared for. Since this is Cloud, Microsoft does this for you. But any problems Microsoft has to have some impact on your end users. And you may want to have that visibility for your users. Microsoft provides this to Admins when they login to the portal, but while useful you may want to use that data in other ways than those planned by Microsoft.
22 kwi 2019