Error Catching in Powershell Security Group Script - powershell

Question

Making a script at work to save some time getting approval from a Security Group owner when someone requests access to a group.
It works OK, but not great. The idea is to create a draft in Outlook2010 that is auto-filled with SG Manager Email address, Subject entered by Analyst. The body contains the requesting users Office, Dept, Manager, and Job title.
It does all this fine, but there is zero error catching, so for example, if the group name entered by the Analyst is wrong or annoyingly has a space at the end, it retains the information saved in the $managerEmail from last time you run it (I thought -like would sort this, but it does not).
Also, it only works for one user, one group, one email - where in reality there could be multiple users requesting access or a user requesting access to multiple groups. I'm looking for a hint in the right direction - would I need to employ a loop of some kind in it to accept multiple inputs and create multiple Email drafts?
It's a mash of bits of scripts together with my own extremely novice "code" so I'm sure there are parts that do nothing of value so any cleanup advise would also be appreciated, I'm not sensitive about it so any thoughts please share.
Get-Module -ListAvailable
Import-Module ActiveDirectory
#Below is user inputs required
$User = Read-Host -Prompt 'Input the user name'
$Group = Read-Host -Prompt 'Input Group Name'
$Notify = Read-Host -Prompt 'Input Notify Subject Line'
#Below is the user info
Get-ADUser -Filter {name -like $user}
if ($User -ne $null)
{
$Find = Get-ADUser $User -Server americas.cshare.net –Properties * |
Select-Object Office, Department, Name, Manager, Title
$Office = $Find.Office
$Dept = $Find.Department
$Title = $Find.Title
$Name = $Find.Name
$Usermanager = $Find.Manager
}
$UM = (get-aduser -Identity $Usermanager -Server americas.cshare.net -Properties Name);
$UserManagerName = $UM.Name;
#Below is get owner name and email need to add error catching
Get-ADGroup -Filter {name -like $Group} -Server americas.cshare.net -Properties ManagedBy |
ForEach-Object {
$managedBy = $_.ManagedBy;
if ($managedBy -ne $null)
{
$manager = (get-aduser -Identity $managedBy -Server americas.cshare.net -Properties emailAddress);
$managerName = $manager.Name;
$managerEmail = $manager.emailAddress;
}
else
{
$managerName = 'N/A';
$managerEmail = 'N/A';
}
Write-Output $_;
} |
Select-Object -Property #(
#{n = 'Group Name'; e = {$_.Name}}
#{n = 'Managed By Name'; e = {$managerName}}
#{n = 'Managed By Email'; e = {$managerEmail}}
)
#Below is the email part saves a draft to check yourself before sending
$ol = New-Object -comObject Outlook.Application
$mail = $ol.CreateItem(0)
$null = $Mail.Recipients.Add("$managerEmail")
$Mail.Subject = "$Notify"
$Mail.Body = #"
Dear $managerName,
$Name has requested to be added to the security group $Group
Job Role: $Title
Department: $Dept
Office: $Office
Manager: $UserManagerName
As the owner of $Group, can you review this request and approve/deny accordingly.
Please REPLY ALL when you respond.
Kind Regards,
Service Desk
"#
$Mail.Save()

Answer 1

So I took a stab at it and added validation steps, but you don't really have much cause for "error handling" exactly. Since this script depends on a lot of user input, I cleaned up that process. Also addressed your problem with group searches. The filter doesn't support -match, so I added proper wildcards on each end of the group name (to catch those various bits). Not sure what the Select-Object was for at the end of your pipeline, but that's in there, too, in the form of New-Object.
Import-Module -Name ActiveDirectory
#region User details
do {
$user = Read-Host -Prompt SID
$adArgs = #{
Identity = $user
Server = 'americas.cshare.net'
Properties = 'Office','Department','Name','Manager','Title'
ErrorAction = 'SilentlyContinue'
}
$user = Get-ADUser #adArgs
if (-not $user) {
'SID not found in Active Directory. Try again.'
}
} until ($user)
$userName = $user.Name
$userTitle = $user.Title
$userDept = $user.Department
$userOffice = $user.Office
$userManager = Get-ADUser -Identity $user.Manager -Server americas.cshare.net -Properties Name |
Select-Object -ExpandProperty Name
#endregion
#region Group details
do {
$group = Read-Host -Prompt Group
$adArgs = #{
Filter = "Name -like '*$group*'"
Server = 'americas.cshare.net'
Properties = 'ManagedBy'
ErrorAction = 'SilentlyContinue'
}
$adGroup = Get-ADGroup #adArgs
if (-not $adGroup) {
'Group not found in Active Directory. Try again.'
}
if ($adGroup.Count -gt 1) {
'Multiple groups found matching query. Try again.'
$adGroup = $null
}
} until ($adGroup)
try {
$adArgs = #{
Identity = $adGroup.ManagedBy
Server = 'americas.cshare.net'
Properties = 'emailAddress'
ErrorAction = 'Stop'
}
$groupManager = Get-ADUser #adArgs
} catch {
"Failed to retrieve '$group' manager! $_" # prints the AD error
Pause
Exit
}
$groupManagerName = $groupManager.Name
$groupManagerEmail = $groupManager.emailAddress
#endregion
$subject = Read-Host -Prompt Subject
New-Object -TypeName PSCustomObject -Property #{
'Group Name' = $group
'Managed By Name' = $groupManagerName
'Managed By Email' = $groupManagerEmail
}
#region Draft an email
$ol = New-Object -ComObject Outlook.Application
$mail = $ol.CreateItem(0)
$null = $mail.Recipients.Add($groupManagerEmail)
$mail.Subject = $subject
$mail.Body = #"
Dear $groupManagerName,
$userName has requested to be added to the security group $group
Job Role: $userTitle
Department: $userDept
Office: $userOffice
Manager: $userManager
As the owner of $group, can you review this request and approve/deny accordingly.
Please REPLY ALL when you respond.
Kind Regards,
Service Desk
"#
$mail.Save()
#endregion
Pause