# Please Help:  Can't Get Move-ADObject to work

**URL:** <https://forums.powershell.org/t/please-help-cant-get-move-adobject-to-work/11496>\
**Category:** PowerShell Help\
**Created:** [October 17, 2018, 10:28am UTC](https://forums.powershell.org/t/please-help-cant-get-move-adobject-to-work/11496 "2018-10-17T10:28:40Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![starlord](https://avatars.discourse-cdn.com/v4/letter/s/48db29/32.png) [@starlord](https://forums.powershell.org/u/starlord)\
**Post date:** [October 17, 2018, 10:28am UTC](https://forums.powershell.org/t/please-help-cant-get-move-adobject-to-work/11496/1 "2018-10-17T10:28:40Z")

</div>

Hello,

Please help. The guys on this site have been awesome and I really appreciate all of your help, but I have 1 more issue. My script works almost perfectly, but I can’t get one thing to work and that’s the Move-ADObject to work. The script does everything I need it to, but Move the ADUser to the Disabled Users OU. Here’s my script.

Import-Module ActiveDirectory  
$users= Import-Csv -Path “C:\Output\DisableADUsers91718C.csv”

$DisabledDate = Get-Date  
$LeaveDate = Get-Date -Format “dddd dd MMMM yyyy”  
$DisabledBy = Get-ADUser “$env:username” -properties Mail  
$DisabledByEmail = $DisabledBy.Mail  
$LegalHoldUser = Get-ADuser -Filter \* -SearchBase ‘ou=LegalHold,dc=xxx,dc=com’ -Properties \* | Select-object -Expand SamAccountName

$TargetOU = “ou=Disabled Users,dc=xxx,dc=com”

foreach ($user in $users)  
{  
$SamAccountName = $User.SamAccountName

```
  Set-ADUser $User.SamAccountName -Description "Disabled by $($DisabledBy.name) on $DisabledDate per Ticket INC0065513"
  $ADgroups = Get-ADPrincipalGroupMembership -Identity $User.SamAccountName | where { ($_.Name -ne 'Domain Users') -and ($_.Name -ne 'DisabledUsers') }

  If ($LegalHoldUser -contains $User.SamAccountname)
{
  Remove-ADPrincipalGroupMembership -Identity $($User.SamAccountname) -MemberOf $ADgroups.SamAccountName -Confirm:$false

  Add-ADGroupMember -Identity "DisabledUsers" -Members $User.SamAccountName

  Disable-ADAccount -Identity $($User.SamAccountname)
}
 else
{
  Remove-ADPrincipalGroupMembership -Identity $($User.SamAccountname) -MemberOf $ADgroups.SamAccountName -Confirm:$false

  Add-ADGroupMember -Identity "DisabledUsers" -Members $User.SamAccountName

  Get-ADUser -Identity $User.SamAccountName | Move-ADObject -targetpath $TargetOU
 
  Disable-ADAccount -Identity $($User.SamAccountname)  
}

```

}

```
This is the error I’m getting:

The input object cannot be bound to any parameters for the command either because the command does not take pipeline input or the input and its properties do not match any of the parameters that take pipeline input.  
+ CategoryInfo : InvalidArgument: (CN=Adam Abston,…DC=xxx,DC=com:PSObject) [Move-ADObject], ParameterBindingException  
+ FullyQualifiedErrorId : InputObjectNotBound,Microsoft.ActiveDirectory.Management.Commands.MoveADObject  
+ PSComputerName : GGPDC01
```

---

<div class="post-metadata">

**Author:** ![kajsoren](https://avatars.discourse-cdn.com/v4/letter/k/f07891/32.png) [@kajsoren](https://forums.powershell.org/u/kajsoren)\
**Post date:** [October 17, 2018, 1:23pm UTC](https://forums.powershell.org/t/please-help-cant-get-move-adobject-to-work/11496/2 "2018-10-17T13:23:40Z")

</div>

Looking at the -Identity Parameter, we can see that it does accept pipeline input (ByValue), but it does not appear to support SamAccountName. “or the input and its properties do not match any of the parameters that take pipeline input.”

Perhaps try either .DistinguishedName or .ObjectGUID

```
Get-ADUser $User.DistinguishedName | Move-ADObject -TargetPath $TargetOU
```

-Identity  
Specifies an Active Directory object by providing one of the following property values. The identifier in parentheses is the LDAP display name for the attribute.

```
Distinguished Name

Example: CN=saradavis,OU=users,OU=asia,DC=corp,DC=contoso,DC=com

GUID (objectGUID)

Example: 599c3d2e-f72d-4d20-8a88-030d99495f20

The cmdlet searches the default naming context or partition to find the object. If two or more objects are found, the cmdlet returns a non-terminating error.

This parameter can also get this object through the pipeline or you can set this parameter to an object instance.

Derived types, such as the following are also accepted:

Microsoft.ActiveDirectory.Management.ADGroup

Microsoft.ActiveDirectory.Management.ADUser

Microsoft.ActiveDirectory.Management.ADComputer

Microsoft.ActiveDirectory.Management.ADServiceAccount

Microsoft.ActiveDirectory.Management.ADFineGrainedPasswordPolicy

Microsoft.ActiveDirectory.Management.ADDomain

This example shows how to set this parameter to an ADObject object instance named "ADObjectInstance".

-Identity $ADObjectInstance

Required? true
Position? 1
Default value
Accept pipeline input? True (ByValue)
Accept wildcard characters? false

```

---

<div class="post-metadata">

**Author:** ![starlord](https://avatars.discourse-cdn.com/v4/letter/s/48db29/32.png) [@starlord](https://forums.powershell.org/u/starlord)\
**Post date:** [October 17, 2018, 1:32pm UTC](https://forums.powershell.org/t/please-help-cant-get-move-adobject-to-work/11496/3 "2018-10-17T13:32:18Z")

</div>

Hi Kaj,

Thanks for responding. I tried both the ObjectGUID and the .DistinguishedName, but I’m still getting the same error.

---

<div class="post-metadata">

**Author:** ![kajsoren](https://avatars.discourse-cdn.com/v4/letter/k/f07891/32.png) [@kajsoren](https://forums.powershell.org/u/kajsoren)\
**Post date:** [October 17, 2018, 2:55pm UTC](https://forums.powershell.org/t/please-help-cant-get-move-adobject-to-work/11496/4 "2018-10-17T14:55:35Z")

</div>

Hey Frederick,

There will be a lot here, but later today I can piece this all together in a nicer format.

I noticed when I ran the script the $User did not contain a value so I made this change to call upon the header in the csv.

I also ran into an error at Remove-ADPrincipalGroupMembership, “Cannot validate argument on parameter ‘MemberOf’. The argument is null or empty. Provide an argument that is not null or empty, and then try the command again.”.

I have gotten around this previously by running a foreach loop with the group memberships. I have attached an example from another script I wrote last year.

```
[CmdletBinding()]

    Param (

        [Parameter(Mandatory=$True,
                   ValueFromPipeline=$True,
                   ValueFromPipelineByPropertyName=$True,
                   HelpMessage="Provide an Active Directory User.")]
                   
            [string]$Target,

        [Parameter(Mandatory=$True,
                   ValueFromPipeline=$True,
                   ValueFromPipelineByPropertyName=$True,
                   HelpMessage="Provide one or multiple Active Directory User(s).")]
            
            [string[]]$ADUser
        

    )

    Begin {
    
        Write-Verbose "Importing Module ActiveDirectory"
        Import-Module ActiveDirectory

        Write-Verbose "Preparing to export groups"
        $Export = Get-ADPrincipalGroupMembership -Identity $Target | Select distinguishedname | 
            Where-Object {$_.DistinguishedName -notlike 'Disabled'}
        
    } 
    
    Process {
    
           ForEach ($User in $ADUser) {
                Write-Verbose "Preparing to purge $User of all ADGroups"
                Get-ADPrincipalGroupMembership -Identity $User | ?{$_.DistinguishedName -notlike '*Domain*'} | 
                % {Remove-ADPrincipalGroupMembership -Identity $User -MemberOf $_ -Confirm:$False}
           }

           ForEach ($Group in $Export) {
                Write-Verbose "Preparing to mirror $User to $Target"
                Add-ADGroupMember $Group -Members $ADUser -Confirm:$False
           }
    
    } End {

        Write-Output "Purge Complete"

    }
```

My CSV:

Users  
Test.user.101  
Test.user.102

```
$users= Import-Csv -Path .\FR.csv

$DisabledDate = Get-Date
$LeaveDate = Get-Date -Format "dddd dd MMMM yyyy"
$DisabledBy = Get-ADUser "$env:username" -properties Mail
$DisabledByEmail = $DisabledBy.Mail
$LegalHoldUser = Get-ADuser -Filter * -SearchBase 'ou=LegalHold,dc=xxx,dc=com'

$TargetOU = "ou=Disabled Users,dc=xxx,dc=com"
foreach ($user in $users)
{
$AdUser = Get-ADUser $User.Users

Set-ADUser $AdUser -Description "Disabled by $($DisabledBy.name) on $DisabledDate per Ticket INC0065513"
$ADgroups = Get-ADPrincipalGroupMembership -Identity $AdUser | where { ($_.Name -ne 'Domain Users') -and ($_.Name -ne 'DisabledUsers') }

If ($LegalHoldUser -contains $AdUser)
{
Remove-ADPrincipalGroupMembership -Identity $($AdUser) -MemberOf $ADgroups.SamAccountName -Confirm:$false

#Add-ADGroupMember -Identity "DisabledUsers" -Members $AdUser

Disable-ADAccount -Identity $AdUser
}
else
{
Remove-ADPrincipalGroupMembership -Identity $($AdUser) -MemberOf $ADgroups.SamAccountName -Confirm:$false

#Add-ADGroupMember -Identity "DisabledUsers" -Members $AdUser

Move-ADObject $AdUser -targetpath $TargetOU

Disable-ADAccount -Identity $AdUser
}
}
```

---

<div class="post-metadata">

**Author:** ![starlord](https://avatars.discourse-cdn.com/v4/letter/s/48db29/32.png) [@starlord](https://forums.powershell.org/u/starlord)\
**Post date:** [October 17, 2018, 4:44pm UTC](https://forums.powershell.org/t/please-help-cant-get-move-adobject-to-work/11496/5 "2018-10-17T16:44:28Z")

</div>

ok. Thanks. I really appreciate all your help. I have been trying to get this to work for weeks. I would love to see the nicer format you have. I’m new at powershell and I know my script is a mess.

---

<div class="post-metadata">

**Author:** ![kajsoren](https://avatars.discourse-cdn.com/v4/letter/k/f07891/32.png) [@kajsoren](https://forums.powershell.org/u/kajsoren)\
**Post date:** [October 17, 2018, 9:27pm UTC](https://forums.powershell.org/t/please-help-cant-get-move-adobject-to-work/11496/6 "2018-10-17T21:27:37Z")

</div>

Hello Frederick,

I had some time to go through and work the csv flow. Since the purpose of this is to use a CSV, from my tests I was able to produce the desired results.

Notations  
I commented out “DisabledUsers” since I did not create that group in my AD Environment  
A few additional items I would change:  
The check for the “Active Directory” Module  
Turn $LegalHoldOu, $TargetOU into parameters  
Turn “Ticket Number” into a parameter  
Add a Help File  
Better Error Handling

This should get you off the ground running.

## CSV: Users

Test.user.101  
Test.user.102  
test.user.103

```
[cmdletbinding()]

    PARAM(

        [parameter( Mandatory=$True,
                    ValueFromPipeline=$False,
                    ValueFromPipelineByPropertyName=$False
                    )]

                [string]$Path,
                

                
                [switch]$LogErrors
                )

BEGIN {

    Try {
        
        Write-Debug $Path
        Test-Path -Path $Path -ErrorAction Stop
        }

    Catch {
        
        Write-Warning "Unable to locate $Path"
        Exit
        }

    Try {

        
        Get-Module ActiveDirectory -ErrorAction Stop
        }

    Catch {

        Write-Warning "Module is not currently installed"
        Exit
        }
    
}

PROCESS {

    $Items = Import-csv $Path
    
    Foreach ($User in $Items) {

        Write-Debug $User

        $DisabledDate = Get-Date
        $LeaveDate = Get-Date -Format "dddd dd MMMM yyyy"
        $DisabledBy = Get-ADUser "$env:USERNAME" -Properties Mail
        $DisabledByEmail = $DisabledBy.Mail
        $LegalHoldOU = "*ou=LegalHold,dc=xxx,dc=com*"
        $TargetOU = "ou=Disabled Users,dc=xxx,dc=com"

        Write-Debug "OUTPUT:$DisabledDate,$LeaveDate,$DisabledBy,$DisabledByEmail,$LegalHoldOU"

        Try {

            Write-Debug $User

            $AdUser = Get-Aduser $User.Users

            Write-Debug $AdUser
            Write-Verbose "Attempting to Set $AdUser"

            Set-ADUser $AdUser -Description "Disabled by $DisabledBy on $DisabledDate per Ticket INC0065513"
            
            Write-Debug $AdUser.DistinguishedName

                If ($AdUser.DistinguishedName -like $LegalHoldOU) {
            
                    Write-Verbose "$AdUser found in $LegalHoldOU"
            
                    Get-ADPrincipalGroupMembership -Identity $AdUser | ?{$_.DistinguishedName -notlike '*Domain*'} | % {Remove-ADPrincipalGroupMembership -Identity $AdUser -MemberOf $_ -Confirm:$False}
                    #Add-ADGroupMember -Identity "DisabledUsers" -Members $AdUser
                    Write-Verbose "Attempting to Disable $AdUser"
                    Disable-ADAccount -Identity $AdUser
                    }

                else {

                    Write-Verbose "Non-Legalhold, preparing to remove memberships."
                    Get-ADPrincipalGroupMembership -Identity $AdUser | ?{$_.DistinguishedName -notlike '*Domain*'} | % {Remove-ADPrincipalGroupMembership -Identity $AdUser -MemberOf $_ -Confirm:$False}
                    

                    #Add-ADGroupMember -Identity "DisabledUsers" -Members $AdUser

                    Write-Verbose "Attempting to move $AdUser"
                    Write-Debug "$TargetOU"
                    Write-Debug $AdUser.DistinguishedName
                    
                    Move-ADObject $AdUser -TargetPath $TargetOU

                    Write-Verbose "Attempting to Disable $AdUser"
                    Disable-ADAccount -Identity $AdUser
                    }

            }
        
        
        Catch {

            if ($LogErrors) {

                    $Logging = "$AdUser $(Get-Date) $_"
                    $Logging | Out-File C:\Users\$Env:UserName\Documents\ErrorLog.txt -Append
                    Write-Warning "Logged to C:\Users\$Env:UserName\Documents\ErrorLog.txt"
        
              }

        }

        }
        }
```

Output with -Verbose included  
#Removed Company OU Information

VERBOSE: Attempting to Set CN=Test.User.101,“_ou=LegalHold,dc=xxx,dc=com_”  
VERBOSE: CN=Test.User.101,“_ou=LegalHold,dc=xxx,dc=com_” found in “_ou=LegalHold,dc=xxx,dc=com_”  
VERBOSE: Attempting to Disable CN=Test.User.101,OU=Sales,“_ou=LegalHold,dc=xxx,dc=com_”  
VERBOSE: Attempting to Set CN=Test.User.102,“_ou=LegalHold,dc=xxx,dc=com_”  
VERBOSE: CN=Test.User.102,“_ou=LegalHold,dc=xxx,dc=com_” found in “_ou=LegalHold,dc=xxx,dc=com_”  
VERBOSE: Attempting to Disable CN=Test.User.102,“_ou=LegalHold,dc=xxx,dc=com_”  
VERBOSE: Attempting to Set CN=Test.User.103,“_ou=LegalHold,dc=xxx,dc=com_”  
VERBOSE: CN=Test.User.103,“_ou=LegalHold,dc=xxx,dc=com_” found in “_ou=LegalHold,dc=xxx,dc=com_”  
VERBOSE: Attempting to Disable CN=Test.User.103,“_ou=LegalHold,dc=xxx,dc=com_”

#Different OU from $LegalHoldOU

VERBOSE: Attempting to Set CN=Test.User.101,dc=xxx,dc=xxx  
VERBOSE: Non-Legalhold, preparing to remove memberships.  
VERBOSE: Attempting to move CN=Test.User.101,dc=xxx,dc=xxx  
VERBOSE: Attempting to Disable CN=Test.User.101,OU=Sales,dc=xxx,dc=xxx  
VERBOSE: Attempting to Set CN=Test.User.102,dc=xxx,dc=xxx  
VERBOSE: Non-Legalhold, preparing to remove memberships.  
VERBOSE: Attempting to move CN=Test.User.102,dc=xxx,dc=xxx  
VERBOSE: Attempting to Disable CN=Test.User.102,dc=xxx,dc=xxx  
VERBOSE: Attempting to Set CN=Test.User.103,dc=xxx,dc=xxx  
VERBOSE: Non-Legalhold, preparing to remove memberships.  
VERBOSE: Attempting to move CN=Test.User.103,dc=xxx,dc=xxx  
VERBOSE: Attempting to Disable CN=Test.User.103,dc=xxx,dc=xxx

---

<div class="post-metadata">

**Author:** ![starlord](https://avatars.discourse-cdn.com/v4/letter/s/48db29/32.png) [@starlord](https://forums.powershell.org/u/starlord)\
**Post date:** [October 18, 2018, 9:31am UTC](https://forums.powershell.org/t/please-help-cant-get-move-adobject-to-work/11496/7 "2018-10-18T09:31:15Z")

</div>

Hi Kaj,

With a few modifications, this works great. You have probably saved my job. Thanks again for all your help.

---

<div class="post-metadata">

**Author:** ![js2010](https://avatars.discourse-cdn.com/v4/letter/j/ebca7d/32.png) [@js2010](https://forums.powershell.org/u/js2010)\
**Post date:** [October 18, 2018, 9:39am UTC](https://forums.powershell.org/t/please-help-cant-get-move-adobject-to-work/11496/8 "2018-10-18T09:39:03Z")

</div>

Normally something like this should work, unless get-aduser isn’t returning anything.

```
get-aduser myuser | move-adobject -targetpath $ou
```

---

<div class="post-metadata">

**Author:** ![dotnVo](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@dotnVo](https://forums.powershell.org/u/dotnVo)\
**Post date:** [May 16, 2024, 8:34pm UTC](https://forums.powershell.org/t/please-help-cant-get-move-adobject-to-work/11496/9 "2024-05-16T20:34:13Z")

</div>