PowerShell Pipeline Script Block inside Hashtable - powershell

Question

Hopefully a PowerShell noob question, but how do I access the current pipeline object inside a script block which is also within a hashtable?
Here is what I'm trying to do in its entirety:
Get-ADGroupMember "Group Name" |
Where {$_.objectClass -eq "user"} |
Get-ADUser -properties extensionAttribute1 |
Where {$_.extensionAttribute1 -ne ($_.UserPrincipalName -replace "#ADdomain.com", "#GAdomain.com")} |
Set-ADUser -replace #{extensionAttribute1=&{$_.UserPrincipalName -replace "#ADdomain.com", "#GAdomain.com"}}
I have everything working except for that last line, where the new extensionAttribute1 should be generated from the current users UserPrincipalName, replacing the domain. Running this code results in an error:
+ Set-ADUser <<<< -replace #{ExtensionAttribute1=&{$_.UserPrincipalName -replace "#ADdomain.com", "#GAdomain.com"}}
+ CategoryInfo : InvalidOperation: (CN=Bar\, Fo...ADdomain,DC=com:ADUser) [Set-ADUser], ADInvalidOperationException
+ FullyQualifiedErrorId : replace,Microsoft.ActiveDirectory.Management.Commands.SetADUser
Replacing the code inside the script block with a string works ok (below), so it seems like some sort of access issue to the current pipeline object. Does $_ not work in this case?
Set-ADUser -replace #{extensionAttribute1=&{"foobar"}}

Answer 1

The short answer seems to be using a foreach in your pipeline, as such:
Get-ADGroupMember "Group Name" |
Where {$_.objectClass -eq "user"} |
Get-ADUser -properties extensionAttribute1 |
Where {$_.extensionAttribute1 -ne ($_.UserPrincipalName -replace "#ADdomain.com", "#GAdomain.com")} |
foreach-objct {Set-ADUser $_ -replace #{extensionAttribute1=&{$_.UserPrincipalName -replace "#ADdomain.com", "#GAdomain.com"}}}
As for why, I'm pretty sure it's because Set-ADUser only accepts one object, whether it's one ADUser or one collection of ADUsers. Since $_ represents this, the way you had it was causing Set-ADUser to see $_ as the one object you were providing in the pipeline - the group of users (instead of each individual user).
Note: The following is speculation! If I'm wrong please correct me!
Regarding Set-ADUser taking one or more objects... here's my guess. If you look at the Input Types of Set-ADUser, it gives the types of None or Microsoft.ActiveDirectory.Management.ADUser. But as you have seen, you can also pass along a collection of ADUser objects and Set-ADUser will accept that as well. From my understanding of that cmdlet, when you call it you can run the same Set command on all objects in that collection. For instance, you could do as you mentioned (assuming $users contains everything in the pipeline up until then):
$users | Set-ADUser -replace #{extensionAttribute1=&{"foobar"}}
My guess is that under the hood, Set-ADUser is accepting $users as the single parameter value (by setting the ValueFromPipeline attribute to true in the code) and applying the parameters you provided to each object therein. Since the iteration of the collection is happening within the cmdlet's code (which is no longer in PowerShell, it's the compiled .Net code), the $_ would have no use here in terms of representing each object.
I'm not sure the mechanics of why the pipeline lets you run Get-ADUser in a pseudo-foreach fashion since they have the same input types (you called that in a similar manner without using foreach) but based on the evidence, I have to assume it's under the hood. If anyone has further insights, I'm definitely curious to know. I may be totally off base!