title: powershell: Set-ADUser : The requested operation did not satisfy one or more constraints associated with the class of the object
body: <p>To test another Script, I created a quick and dirty Powershellscript to be able to create and delete a lot of Useraccounts in multiple OUs in 2 different domains.</p>
  
  <p>While the creation works without problems, I can't manage to fill the accounts via Set-AdUser with some attributes, when setting up <code>$num</code> with a value above 1000. However: the Script works fine if I start at 1 or 100.</p>
  
  <p>I always reveice the following error when using 1000+:</p>
  
  <pre><code>Set-ADUser : The requested operation did not satisfy one or more constraints associated with the class of the object
  At C:\Users\Administrator.TEST\Desktop\ps\createSomeUsers.ps1:117 char:9
  +         Set-ADUser -Identity $num -replace $hash -Server $dc2 -Credential $W ...
  + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      + CategoryInfo          : InvalidOperation: (10000000:ADUser) [Set-ADUser], ADInvalidOperationException
      + FullyQualifiedErrorId : ActiveDirectoryServer:8212,Microsoft.ActiveDirectory.Management.Commands.SetADUser
  </code></pre>
  
  <hr>
  
  <p>Where does this come from? Is that a problem in my Script? If I use the set-AdUser manually with a value of 10000000 it seems to work without a problem.</p>
  
  <p>For testing purposes it is essential that I use a number with 8 digits!</p>
  
  <p>Here's the whole thing:</p>
  
  <pre><code>$dc1 = "192.168.3.99" # DC1
  $dc2 = "192.168.2.99"  # DC2
  
  # OUs in where to create the accounts
  $ou1_1 = "OU=Users,OU=mop,OU=e01,OU=DE,OU=EMEA,DC=relf,DC=com"
  $ou2_1 = "OU=Users,OU=loh,OU=e03,OU=DE,OU=EMEA,DC=relf,DC=com"
  $ou3_1 = "OU=Users,OU=fer,OU=e05,OU=DE,OU=EMEA,DC=relf,DC=com"
  
  $ou1_2 = "OU=Users,OU=mop,OU=e01,OU=DE,OU=EMEA,DC=TEST,DC=com"
  $ou2_2 = "OU=Users,OU=loh,OU=e03,OU=DE,OU=EMEA,DC=TEST,DC=com"
  $ou3_2 = "OU=Users,OU=fer,OU=e05,OU=DE,OU=EMEA,DC=TEST,DC=com"
  
  # number of users in OUs
  $ou1_amount = 1
  $ou2_amount = 1
  $ou3_amount = 1
  
  # numeration
  $num = 10000000
  
  # total Nr. of accounts
  $acc_total = $ou1_amount + $ou2_amount + $ou3_amount
  
  # path and filename 4 .logfiles
  $invocation = (Get-Variable MyInvocation).Value
  $curdir = Split-Path $invocation.MyCommand.Path
  # check if logfile folder is not created yet, if not: create
  $tp = $curdir + "\logfiles\"
  if (!(Test-Path -Path $tp)) {
  new-item $tp -itemtype directory
  }
  $logfilepath = $tp
  
  # Username and PW for dc1 and dc2:
  $creds1 = "relf\PS-User"
  $creds2 = "TEST\PS-User"
  $pass1 = gc $curdir"\securestring1.txt" | convertto-securestring 
  $pass2 = gc $curdir"\securestring2.txt" | convertto-securestring 
  $WPS_AdminCredentials1 = new-object -typename System.Management.Automation.PSCredential -argumentlist $creds1,$pass1    
  $WPS_AdminCredentials2 = new-object -typename System.Management.Automation.PSCredential -argumentlist $creds2,$pass2   
  
  # Attributes
  $attributes = "c","co","company","countryCode","department","Description","displayName",
                  "givenName","mail","physicalDeliveryOfficeName","postalAddress",
                  "postalCode","sAMAccountName","sn","st","streetAddress",
                  "telephoneNumber","title","wWWHomePage","l","postOfficeBox"
  
  # The ultimate question
  $d_O_c = Read-Host '[D]elete OR [C]reate?'
  
  if ($d_O_c -eq "c") {
      write-host "OU1"
      while ($ou1_amount -gt 0) {
          New-ADUser -Name $num -Path $ou1_1 -SamAccountName $num -DisplayName $num -Server $dc1 -Credential $WPS_AdminCredentials1 `
          -AccountPassword (ConvertTo-SecureString "pw1234" -AsPlainText -Force) -ChangePasswordAtLogon $true -Enabled $true
  
          New-ADUser -Name $num -Path $ou1_2 -SamAccountName $num -DisplayName $num -Server $dc2 -Credential $WPS_AdminCredentials2 `
          -AccountPassword (ConvertTo-SecureString "pw1234" -AsPlainText -Force) -ChangePasswordAtLogon $true -Enabled $true
  
          write-host $num "of" $acc_total "created"
          $ou1_amount--
          $num++
          }
  
      write-host "OU2"
      while ($ou2_amount -gt 0) {
          New-ADUser -Name $num -Path $ou2_1 -SamAccountName $num -DisplayName $num -Server $dc1 -Credential $WPS_AdminCredentials1 `
          -AccountPassword (ConvertTo-SecureString "pw1234" -AsPlainText -Force) -ChangePasswordAtLogon $true -Enabled $true
  
          New-ADUser -Name $num -Path $ou2_2 -SamAccountName $num -DisplayName $num -Server $dc2 -Credential $WPS_AdminCredentials2 `
          -AccountPassword (ConvertTo-SecureString "pw1234" -AsPlainText -Force) -ChangePasswordAtLogon $true -Enabled $true
  
          write-host $num "of" $acc_total "created"
          $ou2_amount--
          $num++
          }
  
      write-host "OU3"
      while ($ou3_amount -gt 0) {
          New-ADUser -Name $num -Path $ou3_1 -SamAccountName $num -DisplayName $num -Server $dc1 -Credential $WPS_AdminCredentials1 `
          -AccountPassword (ConvertTo-SecureString "pw1234" -AsPlainText -Force) -ChangePasswordAtLogon $true -Enabled $true
  
          New-ADUser -Name $num -Path $ou3_2 -SamAccountName $num -DisplayName $num -Server $dc2 -Credential $WPS_AdminCredentials2 `
          -AccountPassword (ConvertTo-SecureString "pw1234" -AsPlainText -Force) -ChangePasswordAtLogon $true -Enabled $true
  
          write-host $num "of" $acc_total "created"
          $ou3_amount--
          $num++
          }
  `
      $num--
      while ($num -ge 10000000) {
          $hash = @{}
          $attributes | % {
              $hash[$_] = $num
          }
          Set-ADUser -Identity $num -replace $hash -Server $dc2 -Credential $WPS_AdminCredentials2
          write-host $num "edited"
          $num--
      }
  }
  elseif ($d_O_c -eq "d") {
      $latest = 10000000 + $acc_total
      $latest--
      while ($latest -ge 10000000) {
      Remove-ADUser -Identity $latest -Confirm:$false -Server $dc1 -Credential $WPS_AdminCredentials1
      Remove-ADUser -Identity $latest -Confirm:$false -Server $dc2 -Credential $WPS_AdminCredentials2
      write-host $latest "deleted"
      $latest--
      }
  }
  </code></pre>
  
  <p>EDIT: As mentioned by Matt in the comments, the error message is simply related to some restrictions that are on some of the attributes in the AD.
  Im now using another, shorter value for all attributes.
  Thanks for the help!</p>