Scroll Top
Evotec Services sp. z o.o., ul. Drozdów 6, Mikołów, 43-190, Poland
+48 502 469 760
contact@evotec.pl

Get-ADObject : The server has returned the following error: invalid enumeration context.

Get-ADObject : The server has returned the following error: invalid enumeration context.
PowerShellBlack
By Przemyslaw Klys Active Directory PowerShell May 15, 2020

In the last weeks, I'm working on a PowerShell module that the main goal is to work on gathering and fixing GPOs. I've been testing my module a lot of times on my test environment, and it worked fine till the moment I run it on production, and it started to fail pretty quickly. The difference between my environment and production is 25 GPOs vs. 5000 GPOs. The error I was getting:

Get-ADObject : The server has returned the following error: invalid enumeration context.
At C:\Users\Administrator\Documents\WindowsPowerShell\Modules\GPOZaurr\0.0.26\GPOZaurr.psm1:1987 char:13
+ Get-ADObject @Splat -Properties DisplayName, Name, Create …
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [Get-ADObject], ADException
+ FullyQualifiedErrorId : The server has returned the following error: invalid enumeration context.,Microsoft.ActiveDirectory.Management.Commands.GetADObject

The error doesn't tell much but I've seen the error in multiple other situations mainly when using Get-ADUser, Get-ADComputer, or Get-ADGroup, but I'm confident that it touches all AD cmdlets. The errors would be very similar:

Get-ADUser: The server has returned the following error: invalid enumeration context.

Get-ADComputer: The server has returned the following error: invalid enumeration context.

Get-ADGroup: The server has returned the following error: invalid enumeration context.

The server has returned the following error: invalid enumeration context.

The issue comes from using ForEach-Object on AD cmdlets. While ForEach-Object is excellent and allows you to execute action over the pipeline as objects are read, it causes Get-ADObject to timeout if actions taken during pipeline are taking a too long time. A single query has a time limit. If you start a query on Get-ADObject that executes multiple operations on every object from the pipeline, the time adds up and the query timeouts.

Get-ADObject @Splat -Properties DisplayName, Name, Created, Modified, gPCFileSysPath, gPCFunctionalityVersion, gPCWQLFilter, gPCMachineExtensionNames, Description, CanonicalName, DistinguishedName | ForEach-Object -Process {
    $DomainCN = ConvertFrom-DistinguishedName -DistinguishedName $_.DistinguishedName -ToDomainCN
    $Output = [ordered]@{ }
    $Output['DisplayName'] = $_.DisplayName
    $Output['DomainName'] = $DomainCN
    $Output['Description'] = $_.Description
    $Output['GUID'] = $_.Name -replace '{' -replace '}'
    $Output['Path'] = $_.gPCFileSysPath
    $Output['FunctionalityVersion'] = $_.gPCFunctionalityVersion
    $Output['Created'] = $_.Created
    $Output['Modified'] = $_.Modified
    $Output['GPOCanonicalName'] = $_.CanonicalName
    $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_.DistinguishedName -ToDC
    $Output['GPODistinguishedName'] = $_.DistinguishedName
    [PSCustomObject] $Output
}

So while small query like above works great, because it's just doing some small conversion of an object – using it nested to another function with another ForEach-Object and checking for more values makes AD Cmdlets timeout. My original query looks like below

Get-GPOZaurrAD @getGPOZaurrADSplat | ForEach-Object -Process {
    Write-Verbose "Get-GPOZaurrOwner - Processing GPO: $($_.DisplayName) from domain: $($_.DomainName)"
    $ACL = Get-ADACLOwner -ADObject $_.GPODistinguishedName -Resolve -ADAdministrativeGroups $ADAdministrativeGroups
    $Object = [ordered] @{
        DisplayName       = $_.DisplayName
        DomainName        = $_.DomainName
        GUID              = $_.GUID
        DistinguishedName = $_.GPODistinguishedName
        Owner             = $ACL.OwnerName
        OwnerSid          = $ACL.OwnerSid
        OwnerType         = $ACL.OwnerType
    }
    if ($IncludeSysvol) {
        $FileOwner = Get-FileOwner -JustPath -Path $_.Path -Resolve
        $Object['SysvolOwner'] = $FileOwner.OwnerName
        $Object['SysvolSid'] = $FileOwner.OwnerSid
        $Object['SysvolType'] = $FileOwner.OwnerType
        $Object['SysvolPath'] = $_.Path
    }
    [PSCUstomObject] $Object
}

A Get-GPOZaurrAD function which is a wrapper around  Get-ADObject. It queries AD, and for each object returned, it checks the GPO Owner and SysVol Owner. This process taking about 1 second per each check, makes the connection to Active Directory timeout. Of course, during my tests on 25 GPOs, the timeout won't happen, but as you imagine querying 5000 AD objects, each taking 1 second it means a single Get-ADObject query would require around 83 minutes to finish.

Dealing with the problem

There are 2 ways to deal with this problem. The easiest ones are to simply save query first to variable and then either use ForEach-Object or foreach to gather results.

$Objects = Get-GPOZaurrAD @getGPOZaurrADSplat
$Objects | ForEach-Object -Process {
    Write-Verbose "Get-GPOZaurrOwner - Processing GPO: $($_.DisplayName) from domain: $($_.DomainName)"
    $ACL = Get-ADACLOwner -ADObject $_.GPODistinguishedName -Resolve -ADAdministrativeGroups $ADAdministrativeGroups
    $Object = [ordered] @{
        DisplayName       = $_.DisplayName
        DomainName        = $_.DomainName
        GUID              = $_.GUID
        DistinguishedName = $_.GPODistinguishedName
        Owner             = $ACL.OwnerName
        OwnerSid          = $ACL.OwnerSid
        OwnerType         = $ACL.OwnerType
    }
    if ($IncludeSysvol) {
        $FileOwner = Get-FileOwner -JustPath -Path $_.Path -Resolve
        $Object['SysvolOwner'] = $FileOwner.OwnerName
        $Object['SysvolSid'] = $FileOwner.OwnerSid
        $Object['SysvolType'] = $FileOwner.OwnerType
        $Object['SysvolPath'] = $_.Path
    }
    [PSCUstomObject] $Object
}

From my own testing if I am already saving data to variable I prefer the later

$Objects = Get-GPOZaurrAD @getGPOZaurrADSplat
foreach ($_ in $Objects) {
    Write-Verbose "Get-GPOZaurrOwner - Processing GPO: $($_.DisplayName) from domain: $($_.DomainName)"
    $ACL = Get-ADACLOwner -ADObject $_.GPODistinguishedName -Resolve -ADAdministrativeGroups $ADAdministrativeGroups
    $Object = [ordered] @{
        DisplayName       = $_.DisplayName
        DomainName        = $_.DomainName
        GUID              = $_.GUID
        DistinguishedName = $_.GPODistinguishedName
        Owner             = $ACL.OwnerName
        OwnerSid          = $ACL.OwnerSid
        OwnerType         = $ACL.OwnerType
    }
    if ($IncludeSysvol) {
        $FileOwner = Get-FileOwner -JustPath -Path $_.Path -Resolve
        $Object['SysvolOwner'] = $FileOwner.OwnerName
        $Object['SysvolSid'] = $FileOwner.OwnerSid
        $Object['SysvolType'] = $FileOwner.OwnerType
        $Object['SysvolPath'] = $_.Path
    }
    [PSCUstomObject] $Object
}

Alternatively, you can change Active Directory Web Services timeout to a higher value. The second option has two significant issues. One, you need to be in charge of your Active Directory environment, which may be hard enough in environments you would hit this issue. Also, your scripts would only work on AD that has higher values set, hitting errors as soon as you try to use it on similar scale environments that don't have adjusted timeout settings. Second, Microsoft discourages this change. You can read about it in the following article What's New in AD DS: Active Directory Web Services.

Changing the default value of this parameter is strongly discouraged. Most of the search results are returned within 30 minutes.

This means that a single call for Get-ADObject, Get-ADUser, Get-ADComputer (and so on) has to finish in 30 minutes or less. Using ForEach-Object, due to its nature, can impact the time it takes to deliver all records; therefore, you should use it with caution. Knowing this, I opted for the first approach – making sure I can use my scripts anywhere I want to.

Przemyslaw Klys / About Author
System Architect with over 14 years of experience in the IT field. Skilled, among others, in Active Directory, Microsoft Exchange and Office 365. Profoundly interested in PowerShell. Software geek.
More posts by Przemyslaw Klys

Related Posts

Duplicate SPNs
Finding duplicate SPN with PowerShell
Duplicate SPNs aren’t very common but can happen in any Active Directory as there’s no built-in way that tracks and prevent duplicate SPN’s. One has to either know all SPN’s in the environment, track them or check each time whether it already exists or not. Things get more complicated with larger Active Directory environments as people change, new apps are added, old apps are forgotten, but SPNs prevail.
07 Dec 2021
Mastering Active Directory Hygiene: Automating Stale Computer Cleanup with CleanupMonster
Have you ever looked at your Active Directory and wondered, “Why do I still have computers listed that haven’t been turned on since World Cup 2016?” Yeah, we’ve all been there. Keeping AD clean and up-to-date is like trying to organize your garage—it’s easy to put off until it becomes a total mess.
25 Aug 2024
Emailimo merged into PSWriteHTML, IE support and no dependencies
If you don’t know this yet, I use PSWriteHTML a lot. That means I get to test it under a lot of different conditions. I use it in reports, emails for small, medium, and large companies. Today’s blog post summarizes the work I did in the last few weeks over different areas of PSWriteHTML.
12 Nov 2019
Renaming NETBIOS name of Active Directory Error
Recently I was testing renaming the NETBIOS name of an Active Directory domain. While this process is fairly easy, there are a few gotcha’s, and before one would like to rename their domain or NETBIOS name, serious testing is required to be sure everything works after rename. In the end, if something goes wrong, the rollback will not be a walk in a park. It will hurt, and it will eat your time. So there was I going thru the usual steps.
16 Feb 2020
AzureAD – Enable Password Expiration with Password Hash Synchronization
Azure AD Connect allows three ways to make sure the user password is the same in Active Directory and Office 365. Those are Password Hash Sync, Pass-Thru Authentication, and ADFS. While my preferred option to go with would be Pass-Thru Authentication, only Password Hash Synchronization is the easiest and least resource-intensive. It synchronizes user password to Office 365, and even if your Active Directory is down, you can still log in to Office 365. It’s perfect for small and even more significant companies that don’t have resources or can’t guarantee that their infrastructure will stay 100% time online so users can authenticate based on their Active Directory.
24 Feb 2020
PowerShell – Single PSM1 file versus multi-file modules
I’ve been working with PowerShell Modules for a while now, and most of my knowledge about them came from Warren F (psCookieMonster) blog about Building a PowerShell Module. It is a handy piece of information and recommended read for anyone starting up writing PowerShell Modules. He introduces an idea where a module is stored in multiple folders Private, Public, Bin, Lib and so on and having YourModule.psm1 as a wrapper for functions, binaries in those folders, where each function is stored in its file. It’s an excellent concept, and I use it every day. It allows me to jump into a file quickly I want to find and fundamentally easier for development, especially in teams.
16 Nov 2018
PSWinDocumentation.AD
What do we say to writing Active Directory documentation?
It’s no secret that nobody likes creating documentation. I don’t like it, and you don’t like it, even documentation lovers don’t like it. But while you can live without documentation, you really shouldn’t. And I am not talking here only about documentation that is only useful in the onboarding process of new employees or documentation concerning introducing someone to some concepts to get them easily start. I’m talking about documentation for your live environment where you know what you have, how you have set it up, but is still the same after one week, one month, or one year? Usually, not so much. And one of the worst mistakes admin can do is assume that his environment doesn’t change, things are as they were when they were set up.
12 May 2019
Install-Module : A parameter cannot be found that matches parameter name AllowPrerelease.
22 Aug 2018
PowerShell Automating Administration
Microsoft Exchange – Set address book policy based on group membership
0
04 Mar 2016
Compare PowerShell
PowerShell – Comparing advanced objects
Two years ago, I wrote a blog post on how you can compare two or more objects visually in PowerShell that works on Windows, Linux, or macOS. I’ve been using that for a while, but it had a specific flaw. Comparing more advanced objects that you often see (for example, returned by Graph API, two config files) wasn’t working correctly, often throwing errors. The reason for this was that having nested hashtables arrays require more advanced logic. Today I’ve updated my module to use the ConvertTo-FlatObject function, which allows the Compare-MultipleObjects function to compare suitably more advanced objects hopefully. Of course, it should not throw errors anymore.
28 Feb 2022
Office 365 Org Settings
Configuring Office 365 settings using PowerShell – The non-supported way
Office 365 is a huge beast. It has so many services that it’s hard to track all of them. It’s even harder if you want to manage Office 365 using PowerShell. Microsoft makes many different PowerShell modules available for you, such as AzureAD, AzureADPreview, ExchangeOnline, MicrosoftTeams, and recently, Microsoft.Graph. But even with so many different modules, there are still tasks that Microsoft won’t let you do from PowerShell. But it doesn’t mean that it’s not possible to do it. I’ve spent some time tracking how Microsoft does things while you click thru the interface and created an O365Essentials PowerShell module that can do it in an automated way.
26 Sep 2021
Hyper-V Backing Up
Hyper-V – Can’t start Virtual Machine because it’s backing up
Working as a small business often brings you little tasks here and there. Today I’ve decided to shut down the Hyper-V machine to expand its disks. Unfortunately for me, while extending of HDD went great, I couldn’t start Virtual Machine any longer.
25 Feb 2019
IIS Logs Parser in PowerShell
Reading IIS logs with PowerShell
Today I was reading Twitter, as I am pretty addicted to technology news when Adam Bacon mentioned that he’s surprised that no one has rebuilt IIS Parser as pure PowerShell. While this is not entirely true, and some modules can do some parsing, I decided to try my luck. While doing it from scratch in PowerShell is possible, I opted to use an external C# library that does all the heavy lifting and is optimized for speed.
04 Jun 2022
PSWinReporting – Forwarders, Microsoft Teams, Slack, Microsoft SQL and more
16 Sep 2018
PSWinDocumentation – Version 0.1 with Word / Excel export
A few weeks ago I’ve released my first version of PSWinDocumentation. It was simple, one command module where you start it and get some basic AD stuff into Microsoft Word document. Today… I’m releasing a new version that has a bit bigger feature set. Are you ready for it? Let’s go!
23 Aug 2018