How to set the description of a local group to blank

user_2304170 0
Viewed 109

Consider the following code:

# create test group
New-LocalGroup -Name 'Group1' -Description 'xxx'

# update test group description to blank
Set-LocalGroup -Name 'Group1' -Description '' # fails
Set-LocalGroup -Name 'Group1' -Description $null # fails

On the contrary it is possible to create a group without description:

New-LocalGroup -Name 'Group2'

How is it possible to update the group description of a local group to blank without removing the group first? This happens on PowerShell 5.1.

powershell
2 Answers

As Set-LocalGroup fails on that, the only other way I can think of is using ADSI:

$group = [ADSI]"WinNT://$env:COMPUTERNAME/Group1,group"
$group.Description.Value = [string]::Empty
$group.CommitChanges()

It's a workaround of course and I agree with iRon you should do a bug report on this.

user_98986430

Although there are some AD attributes that requires the Putex method, that doesn't count for the Description attribute. Meaning my assumption in the initial comment to the question is wrong, and it is possible to clear the Description attribute with just the Put method`:

$Name = 'Group1'
New-LocalGroup -Name $Name -Description 'xxx'

$Group = [ADSI]"WinNT://./$Name,group"
$Group.Put('Description', '')
$Group.SetInfo()

Get-LocalGroup -Name $Name

Name   Description
----   -----------
Group1

The issue lays purely in the cmdlet parameter definitions. Without going into the C# programming, you might just pull this from the proxy command:

$Command = Get-Command Set-LocalGroup
$MetaData = [System.Management.Automation.CommandMetadata]$Command
$ProxyCommand = [System.Management.Automation.ProxyCommand]::Create($MetaData)
$ProxyCommand

[CmdletBinding(SupportsShouldProcess=$true, ConfirmImpact='Medium', HelpUri='https://go.microsoft.com/fwlink/?LinkId=717979')]
param(
    [Parameter(Mandatory=$true)]
    [ValidateNotNull()]            # <-- Here is the issue
    [ValidateLength(0, 48)]
    [string]
    ${Description},
...

In other words, to quick and dirty workaround this with a proxy command:

function SetLocalGroup {
    [CmdletBinding(SupportsShouldProcess=$true, ConfirmImpact='Medium', HelpUri='https://go.microsoft.com/fwlink/?LinkId=717979')]
    param(
        [Parameter(Mandatory=$true)]
        [AllowEmptyString()]            # <-- Modified
        [ValidateLength(0, 48)]
        [string]
        ${Description},

        [Parameter(ParameterSetName='InputObject', Mandatory=$true, Position=0, ValueFromPipeline=$true, ValueFromPipelineByPropertyName=$true)]
        [ValidateNotNull()]
        [Microsoft.PowerShell.Commands.LocalGroup]
        ${InputObject},

        [Parameter(ParameterSetName='Default', Mandatory=$true, Position=0, ValueFromPipeline=$true, ValueFromPipelineByPropertyName=$true)]
        [ValidateNotNull()]
        
        ${Name},

        [Parameter(ParameterSetName='SecurityIdentifier', Mandatory=$true, Position=0, ValueFromPipeline=$true, ValueFromPipelineByPropertyName=$true)]
        [ValidateNotNull()]
        [System.Security.Principal.SecurityIdentifier]
        ${SID})

    end {
        if ($Description) { Set-LocalGroup @PSBoundParameters }
        elseif ($Name) {
            $Group = [ADSI]"WinNT://./$Name,group"
            $Group.Put('Description', '')
            $Group.SetInfo()
        }
    }
}

SetLocalGroup -Name 'Group1' -Description ''

Related bug report: #16049 AllowEmptyString()] for -Description in Set-LocalGroup/SetLocalUser

user_17010260
Related