Issue With Powershell Loop Iteration

Question

When attempting to run the below code it appears that it's running through my initial foreach loop twice. What am I not seeing? I appreciate any help.

$DC = Get-ADDomainController
$OUs = Get-ADOrganizationalUnit -Filter 'Name -eq "test"'
$TimeStamp = get-date -format D
$description = "Disabled on " + $TimeStamp
$canNotDisableUser =  Get-ADGroupMember -Identity DoNotDisableUsers -Recursive | Select -ExpandProperty Name
$accounts = $null

    # Search for User Accounts inactive for XX Days and Disable if not in DoNotDisable Security Group
    $accounts = Search-ADAccount -SearchBase $OU -AccountInactive -TimeSpan ([timespan]90d) -UsersOnly
        foreach($account in $accounts){
        If ($canNotDisableUser -notmatch $account.Name){
         Disable-ADAccount -Identity $account.DistinguishedName -Verbose
        }

    # Disable Protected from Accidental Deletion from OU
    Get-ADOrganizationalUnit -LDAPFilter '(name=*)'  -SearchBase $OU.DistinguishedName -Server $DC | Set-ADObject -ProtectedFromAccidentalDeletion:$false -Verbose -WhatIf


    # Move Disabled Users to Disabled Users OU & Add Timestamp to Description
    Search-ADAccount –AccountDisabled –UsersOnly –SearchBase $OU.DistinguishedName | Foreach-object {
    Set-ADUser $_ -Description $description -Verbose -WhatIf
    Move-ADObject $_ –TargetPath “OU=Disabled Users, DC=xxx,DC=net” -Verbose -WhatIf
    }

    # Enable Protected from Accidental Deletion from OU
    Get-ADOrganizationalUnit -LDAPFilter '(name=*)'  -SearchBase $OU.DistinguishedName -Server $DC | Set-ADObject -ProtectedFromAccidentalDeletion:$true -Verbose -WhatIf
}

Answer 1

One of the things that will save you LOTS of time in troubleshooting these kinds of issues is "indentation". Make it a habbit of always making sure they are indented correctly.

# Search for User Accounts inactive for XX Days and Disable if not in DoNotDisable Security Group
    $accounts = Search-ADAccount -SearchBase $OU -AccountInactive -TimeSpan ([timespan]90d) -UsersOnly
    foreach($account in $accounts){
        If ($canNotDisableUser -notmatch $account.Name){
            Disable-ADAccount -Identity $account.DistinguishedName -Verbose
        }

     ### YOU probably intend to close the foreach loop here. If so, Move the LAST brace to this place.

        # Disable Protected from Accidental Deletion from OU
        Get-ADOrganizationalUnit -LDAPFilter '(name=*)'  -SearchBase $OU.DistinguishedName -Server $DC | Set-ADObject -ProtectedFromAccidentalDeletion:$false -Verbose -WhatIf


        # Move Disabled Users to Disabled Users OU & Add Timestamp to Description
        Search-ADAccount –AccountDisabled –UsersOnly –SearchBase $OU.DistinguishedName | Foreach-object {
            Set-ADUser $_ -Description $description -Verbose -WhatIf
            Move-ADObject $_ –TargetPath “OU=Disabled Users, DC=xxx,DC=net” -Verbose -WhatIf
        }

        # Enable Protected from Accidental Deletion from OU
        Get-ADOrganizationalUnit -LDAPFilter '(name=*)'  -SearchBase $OU.DistinguishedName -Server $DC | Set-ADObject -ProtectedFromAccidentalDeletion:$true -Verbose -WhatIf
    }

Corrected

    # Search for User Accounts inactive for XX Days and Disable if not in DoNotDisable Security Group
    $accounts = Search-ADAccount -SearchBase $OU -AccountInactive -TimeSpan ([timespan]90d) -UsersOnly
    foreach($account in $accounts){
        If ($canNotDisableUser -notmatch $account.Name){
            Disable-ADAccount -Identity $account.DistinguishedName -Verbose
        }
    }

    # Disable Protected from Accidental Deletion from OU
    Get-ADOrganizationalUnit -LDAPFilter '(name=*)'  -SearchBase $OU.DistinguishedName -Server $DC | Set-ADObject -ProtectedFromAccidentalDeletion:$false -Verbose -WhatIf


    # Move Disabled Users to Disabled Users OU & Add Timestamp to Description
    Search-ADAccount –AccountDisabled –UsersOnly –SearchBase $OU.DistinguishedName | Foreach-object {
        Set-ADUser $_ -Description $description -Verbose -WhatIf
        Move-ADObject $_ –TargetPath “OU=Disabled Users, DC=xxx,DC=net” -Verbose -WhatIf
    }

    # Enable Protected from Accidental Deletion from OU
    Get-ADOrganizationalUnit -LDAPFilter '(name=*)'  -SearchBase $OU.DistinguishedName -Server $DC | Set-ADObject -ProtectedFromAccidentalDeletion:$true -Verbose -WhatIf