# get-qaduser with set-mailbox \*danger\*

**URL:** <https://forums.powershell.org/t/get-qaduser-with-set-mailbox-danger/7568>\
**Category:** PowerShell Help\
**Created:** [November 21, 2016, 3:06pm UTC](https://forums.powershell.org/t/get-qaduser-with-set-mailbox-danger/7568 "2016-11-21T15:06:46Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![dan-potter](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/dan-potter/32/138_2.png) [@dan-potter](https://forums.powershell.org/u/dan-potter)\
**Post date:** [November 21, 2016, 3:06pm UTC](https://forums.powershell.org/t/get-qaduser-with-set-mailbox-danger/7568/1 "2016-11-21T15:06:46Z")

</div>

A powershell novice here managed to disable several hundred accounts using this. When testuser1 is not found the get-mailbox ignores the identity and proceeds to modify every account it can before you catch it!

$user = get-qaduser testuser1 -IncludedProperties msExchRecipientTypeDetails  
Get-Mailbox $user.name | Set-Mailbox -Type Shared

I accidentally stumbled on this issue in 2007 where I managed to change 30k displaynames to ‘$\_.displayname’ and never used the quest cmdlets again.

Anyone know the reasoning for this?

---

<div class="post-metadata">

**Author:** ![donj](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/donj/32/137_2.png) [@donj](https://forums.powershell.org/u/donj)\
**Post date:** [November 21, 2016, 3:18pm UTC](https://forums.powershell.org/t/get-qaduser-with-set-mailbox-danger/7568/2 "2016-11-21T15:18:23Z")

</div>

First, I’d suggest explicitly using a parameter rather than passing $user.name positionally. Just as a good practice.

Second, you should be testing $user to make sure it contains something before using it. Right now, your code is assuming $user is valid, and that assumption is the problem. It isn’t so much “reasoning;” if $user is empty, then it… well, it doesn’t exist, so it doesn’t need to be attached to a parameter positionally, so Get-Mailbox runs as if it was given no input - and gets all mailboxes.

---

<div class="post-metadata">

**Author:** ![skalizar](https://avatars.discourse-cdn.com/v4/letter/s/ecc23a/32.png) [@skalizar](https://forums.powershell.org/u/skalizar)\
**Post date:** [November 21, 2016, 3:34pm UTC](https://forums.powershell.org/t/get-qaduser-with-set-mailbox-danger/7568/3 "2016-11-21T15:34:27Z")

</div>

Get-QADUser is different from Get-ADUser. It can return multiple matches (ANR search?) or nothing, with no error. If you have to use it, use the DN as the identity, or use an ldapfilter search. Also, remember your good friend -whatif, when running off the cuff scripts. I assume there was more to the script then you put in your post, you retrieved msExchRecipientTypeDetails and then didn’t test it before changing the mailbox.

---

<div class="post-metadata">

**Author:** ![dan-potter](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/dan-potter/32/138_2.png) [@dan-potter](https://forums.powershell.org/u/dan-potter)\
**Post date:** [November 21, 2016, 3:49pm UTC](https://forums.powershell.org/t/get-qaduser-with-set-mailbox-danger/7568/4 "2016-11-21T15:49:54Z")

</div>

I didn’t do this, a coworker did. I know how to protect myself:D

The question is why does this happen with the exchange cmdlets?

---

<div class="post-metadata">

**Author:** ![dan-potter](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/dan-potter/32/138_2.png) [@dan-potter](https://forums.powershell.org/u/dan-potter)\
**Post date:** [November 21, 2016, 4:00pm UTC](https://forums.powershell.org/t/get-qaduser-with-set-mailbox-danger/7568/5 "2016-11-21T16:00:18Z")

</div>

Thanks Don. I did verify that using the identity switch still results in getting all mailboxes.

$user = get-aduser dkjfskdjf; Get-Mailbox -Identity $user

---

<div class="post-metadata">

**Author:** ![max-kozlov](https://avatars.discourse-cdn.com/v4/letter/m/50afbb/32.png) [@max-kozlov](https://forums.powershell.org/u/max-kozlov)\
**Post date:** [November 22, 2016, 2:45am UTC](https://forums.powershell.org/t/get-qaduser-with-set-mailbox-danger/7568/6 "2016-11-22T02:45:33Z")

</div>

the problem really in exchange cmdlets  
just test `Get-Mailbox $null / Get-Mailbox -Identity $null` and you get it

I think Exchange team use ($Identity -eq $null) and should use ($PSCmdletBinding.ContainsKey(‘Identity’)) for retrieving all mailboxes  
I think this artefact from v1.0 days 🙂

---

<div class="post-metadata">

**Author:** ![dan-potter](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/dan-potter/32/138_2.png) [@dan-potter](https://forums.powershell.org/u/dan-potter)\
**Post date:** [November 22, 2016, 8:49am UTC](https://forums.powershell.org/t/get-qaduser-with-set-mailbox-danger/7568/7 "2016-11-22T08:49:26Z")

</div>

Thanks Max. Definitely odd why they would write it this way. Even the newest exchangeonline module does it. I have to tell people to be very careful.

---

<div class="post-metadata">

**Author:** ![dotnVo](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@dotnVo](https://forums.powershell.org/u/dotnVo)\
**Post date:** [May 16, 2024, 8:39pm UTC](https://forums.powershell.org/t/get-qaduser-with-set-mailbox-danger/7568/8 "2024-05-16T20:39:52Z")

</div>