Nice script some small improvements needed

This useful script gives good control on the state of your AD accounts. I wanted to show a Warning at 1 and Critical at 2 or more errors, ran into a problem with the script.

Solution:

returning 0 or one element in an array results in a different return variable not supporting the .Count property

change the invoke-expression line to
$result=@(invoke-expression -Command “$command” -OutBuffer 1000)

to correctly process the return value of the script in the NSClient++ call of the powershell script and pass it on we need to use exit $lastexitcode otherwise we are passing on the success of powershell not the return value of the script itself.

So the NSClient++ ini file needs to contain lines like this:

check_ps_lotp_check_ad_account_disabled=cmd /c echo scriptslotp_check_ad_accounts.ps1 AccountDisabled “cn=AAA,dc=BBB,dc=com” Subtree 0 1; exit $lastexitcode | powershell.exe -noprofile -executionpolicy bypass -command –

cn= evaluation is not evaluated by the script, some changes are needed there too or just hardcode the SearchBase variable

That’s it!