Powershell Script Error-Cannot validate argument on parameter 'Property': Cannot index into a null array

Question

I have run a Powershell script found within this article: How to detect applications using "hardcoded" DC name or IP .

Get-WinEvent -ComputerName dc01.contoso.com -MaxEvents 1000 -FilterHashtable @{LogName="Directory Service" ; ID=1139 } | ForEach-Object ` 
{
 $_info = @{
 "Operation" = [string] $_.Properties.Value[0]
 "User" = [string] $_.Properties.Value[2]
 "IP:Port" = [string] $_.Properties.Value[3]
 }
 New-Object psobject -Property $_info
 } 

The error I receive is:

New-Object : Cannot validate argument on parameter 'Property'. The argument is null or empty. Supply an argument that is not null or empty and then try the command again.
At C:\scripts\HideDC.ps1:9 char:37
+        New-Object psobject -Property <<<<  $_info     
    + CategoryInfo          : InvalidData: (:) [New-Object], 
ParameterBindingValidationException
    + FullyQualifiedErrorId : ParameterArgumentValidationError,Microsoft.PowerShell.Commands.NewObjectCommand

Cannot index into a null array.
At C:\scripts\HideDC.ps1:5 char:55
+            "Operation" = [string] $_.Properties.Value[ <<<< 0]
    + CategoryInfo          : InvalidOperation: (0:Int32) [], RuntimeException
    + FullyQualifiedErrorId : NullArray

Can anyone help with this?

Answer 1

tl;dr :

Get-WinEvent -ComputerName dc01.contoso.com -MaxEvents 1000 -FilterHashtable @{
  LogName="Directory Service" ; ID=1139 } |
    ForEach-Object {
      [pscustomobject] @{
        "Operation" = try { [string] $_.Properties.Value[0] } catch {}
        "User" =      try { [string] $_.Properties.Value[2] } catch {}
        "IP:Port" =   try { [string] $_.Properties.Value[3] } catch {}
      }
    }

---

• The Cannot index into a null array error message is telling you that $_.Properties.Value is $null rather than an array, so an attempt to access an element of this non-array fails . ^[1]

The implication is that at least some of the event-log records do not have embedded data values.

• (The New-Object : Cannot validate argument on parameter 'Property' is merely a follow-on error that complains about the -Property argument being $null , because the initial error caused $_info to be $null .)

  • The simplest solution is to use an embedded try { ... } catch {} handler enclosing the $_.Properties.Value[<n>] references, which quietly ignores the case when $_.Properties.Value is $null and causes the overall subexpression to return $null .

  • Also note how you can cast the hashtable literal ( @{ ... } ) directly to type accelerator [pscustomobject] in order to convert it to a custom object.

---

^{[1] Note that since PSv3, trying to index into a value that is non- $null but is also not an array doesn't fail , but quietly returns $null ; eg: $v=20; $v[1] # -> $null $v=20; $v[1] # -> $null .
Indexing into a string value is a special case, however: it returns the character at the specified position: $v='hi'; $v[1] # -> 'i' $v='hi'; $v[1] # -> 'i'}