1

I have already browsed multiple versions of this question and the various solutions given on this and other sites, but none have addressed my issue or why it might be occurring.

I am trying to create several new AD objects using an existing one as a template. That part is working well.

$objectInstance = Get-ADObject -Identity "CN=First Last,OU=Recipients,OU=NewExObjects,DC=DOMAIN,DC=ORG,DC=com" -Properties description,physicalDeliveryOfficeName,company,mailNickname,showInAddressBook,internetEncoding,msExchPoliciesExcluded,msExchRecipientDisplayType,msExchVersion,proxyAddresses,targetAddress

New-ADObject -Instance $objectInstance -Name "NewFirst NewLast" -DisplayName "NewFirst NewLast" -Type "contact" -Path "OU=Recipients,OU=NewExObjects,DC=DOMAIN,DC=ORG,DC=com" -OtherAttributes @{'mail'="NewFirstNewLast@company.org";'givenName'="NewFirst";'sn'="NewLast";'mailNickname'="NewFirstNewLast";'proxyAddresses'="SMTP:NewFirstNewLast@company.org";'targetAddress'="SMTP:NewFirstNewLast@company.org"}

I can even retrieve this new object almost immediately:

$memberInstance = Get-ADObject -Identity "CN=NewFirst NewLast,OU=Recipients,OU=NewExObjects,DC=DOMAIN,DC=ORG,DC=com" -Properties *
Write-Host $memberInstance.DistinguishedName

The above works perfectly, showing me the new object's DN. However, when I attempt to then add the new object to a group, I am getting an error stating that an object with that identity cannot be found:

$groupInstance = Get-ADGroup -Identity "CN=GroupName,OU=Recipients,OU=NewExObjects,DC=DOMAIN,DC=ORG,DC=com" -Properties *
Add-ADGroupMember -Identity $groupInstance.DistinguishedName -Members $memberInstance.DistinguishedName

This produces the following error:

Add-ADGroupMember : Cannot find an object with identity: 'CN=NewFirst NewLast,OU=Recipients,OU=NewExObjects,DC=DOMAIN,DC=ORG,DC=com' under: 'DC=DOMAIN,DC=ORG,DC=com'.

I am completely at a loss as to what I am doing wrong or what I might be missing. Can someone help?

  • 1
    Are you attempting to add a mail contact to a security group? That operation will fail. – Semicolon Jul 8 at 21:04
  • Thank you for your clarifying question. Yes, I am trying to add a Contact to the group that the existing Contacts in the same OU are in. I am able to add it through the AD UI, but not via this script. Am I just going to have to use the UI or some bulk edit tool to add the numerous Contacts I am creating with the script? Thanks again! – C. Dennett Jul 8 at 22:25
1

You appear to be working with a contact object. I am able to reproduce this error when I attempt to add a mail contact to a security group.

A security group requires that its members are accounts or other groups (security principals). Contact objects - lacking a Security Identifier (SID) - are not security principals.


Source: my working knowledge (Also refer to https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/active-directory-security-groups)


Edit follows:

The Add-AdGroupMember cmdlet does not support adding contacts to any groups.

The Add-ADGroupMember cmdlet adds one or more users, groups, service accounts, or computers as new members of an Active Directory group.

Source: https://docs.microsoft.com/en-us/powershell/module/addsadministration/add-adgroupmember?view=win10-ps

It seems as though the cmdlet has a baked-in filter that only includes objects of specific objectClasses -- which is why your contact comes up as not found - it does not meet the filter criteria.


You will need to use a different method to achieve what you're seeking. The easiest thing would be to use the Exchange Management Shell (if in fact you have an on-premises Exchange Server):

Add-DistributionGroupMember -Identity $groupInstance.DistinguishedName -Member $memberInstance.DistinguishedName

Failing that, you will likely have to revert to using Set-AdObject

Set-AdObject -Identity "CN=GroupName,OU=Recipients,OU=NewExObjects,DC=DOMAIN,DC=ORG,DC=com" -Add @{member=$($memberInstance.DistinguishedName)}
  • Thank you for your answer! Yes, I am retrieving a Contact using Get-ADObject (Get-ADUser doesn't work, because these are not User objects), and using its instance as a starting point for new Contacts. The Contact I am using as the "template" is part of a group, so I am also trying to add the newly created Contacts to the same group. Thank you! – C. Dennett Jul 8 at 22:27
  • I just double-checked AD, and the group that I am trying to add the newly created Contacts to is a Distribution Group (as shown on the group's properties under the "General" tab under Group Type). Does this have any effect on the restriction you mentioned in your answer? Thank you! – C. Dennett Jul 8 at 22:34
  • I've updated my answer given your follow-up information; hopefully, it will prove useful. – Semicolon Jul 9 at 16:38
  • 1
    I used Set-ADObject and that worked perfectly! You're a lifesaver! Thank you so much for your time, effort, and insight! Thank you also for explaining why what I was trying didn't work, and what you suggested does work. That is highly appreciated! Marking this as the answer. Thank you again! – C. Dennett Jul 9 at 16:55
0

You are trying to clone AD objects as such, but this doesn't guarantee that they are actually user objects, or anything resembling a security principal (such as a computer object). If you try to add generic objects to a group, this can fail, as groups have specific requirements on which object types they can have as members.

It's a lot better and less error prone to find and clone objects based on their actual type, with commands such as Get-ADUser and New-ADUser (or the same for computers, contacts, groups, and so on).

  • Thank you for your answer! I am actually not trying to create User objects, but rather Contact objects. Because of this, Get-ADUser does not work to retrieve the Contact that I am using as a template for the newly created Contacts (the value I'm storing in the objectInstance variable). I do see that there is a New-ADUser and New-ADComputer, etc, but I do not see New-ADContact. Is there such a function in the ActiveDirectory Module? Thank you! – C. Dennett Jul 8 at 22:30
  • Not in the ActiveDirectory module; however, there are -MailContact (and -DistributionGroup) cmdlets available in the Exchange Management Shell, if applicable. – Semicolon Jul 9 at 15:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.