MSFT_ADComputer.psm1

$script:resourceModulePath = Split-Path -Path (Split-Path -Path $PSScriptRoot -Parent) -Parent
$script:modulesFolderPath = Join-Path -Path $script:resourceModulePath -ChildPath 'Modules'

$script:localizationModulePath = Join-Path -Path $script:modulesFolderPath -ChildPath 'ActiveDirectoryDsc.Common'
Import-Module -Name (Join-Path -Path $script:localizationModulePath -ChildPath 'ActiveDirectoryDsc.Common.psm1')

$script:localizedData = Get-LocalizedData -ResourceName 'MSFT_ADComputer'

<#
    A property map that maps the resource parameters to the corresponding
    Active Directory computer account object attribute.
#>
$script:computerObjectPropertyMap = @(
    @{
        ParameterName = 'ComputerName'
        PropertyName  = 'CN'
    },
    @{
        ParameterName = 'Location'
    },
    @{
        ParameterName = 'DnsHostName'
    },
    @{
        ParameterName = 'ServicePrincipalNames'
        PropertyName  = 'ServicePrincipalName'
    },
    @{
        ParameterName = 'UserPrincipalName'
    },
    @{
        ParameterName = 'DisplayName'
    },
    @{
        ParameterName = 'Path'
        PropertyName  = 'DistinguishedName'
    },
    @{
        ParameterName = 'Description'
    },
    @{
        ParameterName = 'Enabled'
    },
    @{
        ParameterName = 'Manager'
        PropertyName  = 'ManagedBy'
    },
    @{
        ParameterName = 'DistinguishedName'
        ParameterType = 'Read'
        PropertyName  = 'DistinguishedName'
    },
    @{
        ParameterName = 'SID'
        ParameterType = 'Read'
    }
)

<#
    .SYNOPSIS
        Returns the current state of the Active Directory computer account.

    .PARAMETER ComputerName
         Specifies the name of the Active Directory computer account to manage.
         You can identify a computer by its distinguished name, GUID, security
         identifier (SID) or Security Accounts Manager (SAM) account name.

    .PARAMETER RequestFile
        Specifies the full path to the Offline Domain Join Request file to create.

    .PARAMETER EnabledOnCreation
        Specifies if the computer account is created enabled or disabled.
        By default the Enabled property of the computer account will be set to
        the default value of the cmdlet New-ADComputer. This property is ignored
        if the parameter RequestFile is specified in the same configuration.
        This parameter does not enforce the property `Enabled`. To enforce the
        property `Enabled` see the resource ADObjectEnabledState.

    .PARAMETER DomainController
        Specifies the Active Directory Domain Services instance to connect to perform the task.

        Used by Get-ADCommonParameters and is returned as a common parameter.

    .PARAMETER Credential
        Specifies the user account credentials to use to perform the task.

        Used by Get-ADCommonParameters and is returned as a common parameter.

    .PARAMETER RestoreFromRecycleBin
        Try to restore the organizational unit from the recycle bin before
        creating a new one.
#>
function Get-TargetResource
{
    [CmdletBinding()]
    [OutputType([System.Collections.Hashtable])]
    param
    (
        [Parameter(Mandatory = $true)]
        [System.String]
        $ComputerName,

        [Parameter()]
        [ValidateNotNull()]
        [System.String]
        $RequestFile,

        [Parameter()]
        [ValidateNotNull()]
        [System.String]
        $DomainController,

        [Parameter()]
        [ValidateNotNull()]
        [System.Management.Automation.PSCredential]
        [System.Management.Automation.CredentialAttribute()]
        $Credential,

        [Parameter()]
        [ValidateNotNull()]
        [System.Boolean]
        $RestoreFromRecycleBin,

        [Parameter()]
        [ValidateNotNull()]
        [System.Boolean]
        $EnabledOnCreation
    )

    Assert-Module -ModuleName 'ActiveDirectory' -ImportModule

    <#
        These are properties that have no corresponding property in a
        Computer account object.
    #>
    $getTargetResourceReturnValue = @{
        Ensure                = 'Absent'
        ComputerName          = $null
        Location              = $null
        DnsHostName           = $null
        ServicePrincipalNames = $null
        UserPrincipalName     = $null
        DisplayName           = $null
        Path                  = $null
        Description           = $null
        Enabled               = $false
        Manager               = $null
        DomainController      = $DomainController
        Credential            = $Credential
        RequestFile           = $RequestFile
        RestoreFromRecycleBin = $RestoreFromRecycleBin
        EnabledOnCreation     = $EnabledOnCreation
        DistinguishedName     = $null
        SID                   = $null
        SamAccountName        = $null
    }

    $getADComputerResult = $null

    try
    {
        <#
            Create an array of the Active Directory Computer object property
            names to retrieve from the Computer object.
        #>
        $computerObjectProperties = Convert-PropertyMapToObjectProperties -PropertyMap $script:computerObjectPropertyMap

        <#
            When the property ServicePrincipalName is read with Get-ADComputer
            the property name must be 'ServicePrincipalNames', but when it is
            written with Set-ADComputer the property name must be
            'ServicePrincipalName'. This difference is handled here.
        #>
        $computerObjectProperties = @($computerObjectProperties |
                Where-Object -FilterScript {
                    $_ -ne 'ServicePrincipalName'
                })

        $computerObjectProperties += @('ServicePrincipalNames')

        Write-Verbose -Message ($script:localizedData.RetrievingComputerAccount -f $ComputerName)

        $getADComputerParameters = Get-ADCommonParameters @PSBoundParameters
        $getADComputerParameters['Properties'] = $computerObjectProperties

        # If the computer account is not found Get-ADComputer will throw an error.
        $getADComputerResult = Get-ADComputer @getADComputerParameters

        Write-Verbose -Message ($script:localizedData.ComputerAccountIsPresent -f $ComputerName)

        $getTargetResourceReturnValue['Ensure'] = 'Present'
        $getTargetResourceReturnValue['ComputerName'] = $getADComputerResult.CN
        $getTargetResourceReturnValue['Location'] = $getADComputerResult.Location
        $getTargetResourceReturnValue['DnsHostName'] = $getADComputerResult.DnsHostName
        $getTargetResourceReturnValue['ServicePrincipalNames'] = [System.String[]] $getADComputerResult.ServicePrincipalNames
        $getTargetResourceReturnValue['UserPrincipalName'] = $getADComputerResult.UserPrincipalName
        $getTargetResourceReturnValue['DisplayName'] = $getADComputerResult.DisplayName
        $getTargetResourceReturnValue['Path'] = Get-ADObjectParentDN -DN $getADComputerResult.DistinguishedName
        $getTargetResourceReturnValue['Description'] = $getADComputerResult.Description
        $getTargetResourceReturnValue['Enabled'] = $getADComputerResult.Enabled
        $getTargetResourceReturnValue['Manager'] = $getADComputerResult.ManagedBy
        $getTargetResourceReturnValue['DomainController'] = $DomainController
        $getTargetResourceReturnValue['Credential'] = $Credential
        $getTargetResourceReturnValue['RequestFile'] = $RequestFile
        $getTargetResourceReturnValue['RestoreFromRecycleBin'] = $RestoreFromRecycleBin
        $getTargetResourceReturnValue['EnabledOnCreation'] = $EnabledOnCreation
        $getTargetResourceReturnValue['DistinguishedName'] = $getADComputerResult.DistinguishedName
        $getTargetResourceReturnValue['SID'] = $getADComputerResult.SID
        $getTargetResourceReturnValue['SamAccountName'] = $getADComputerResult.SamAccountName
    }
    catch [Microsoft.ActiveDirectory.Management.ADIdentityNotFoundException]
    {
        Write-Verbose -Message ($script:localizedData.ComputerAccountIsAbsent -f $ComputerName)
    }
    catch
    {
        $errorMessage = $script:localizedData.FailedToRetrieveComputerAccount -f $ComputerName
        New-InvalidOperationException -Message $errorMessage -ErrorRecord $_
    }

    return $getTargetResourceReturnValue
}

<#
    .SYNOPSIS
        Determines if the Active Directory computer account is in the desired state.

    .PARAMETER ComputerName
         Specifies the name of the Active Directory computer account to manage.
         You can identify a computer by its distinguished name, GUID, security
         identifier (SID) or Security Accounts Manager (SAM) account name.

    .PARAMETER Ensure
        Specifies whether the computer account is present or absent.
        Valid values are 'Present' and 'Absent'. The default is 'Present'.

    .PARAMETER UserPrincipalName
        Specifies the UPN assigned to the computer account.

    .PARAMETER DisplayName
        Specifies the display name of the computer.

    .PARAMETER Path
        Specifies the X.500 path of the container where the computer is located.

    .PARAMETER Location
        Specifies the location of the computer, such as an office number.

    .PARAMETER DnsHostName
        Specifies the fully qualified domain name (FQDN) of the computer.

    .PARAMETER ServicePrincipalNames
        Specifies the service principal names for the computer account.

    .PARAMETER Description
        Specifies a description of the computer account.

    .PARAMETER Manager
        Specifies the user or group Distinguished Name that manages the computer
        account. Valid values are the user's or group's DistinguishedName,
        ObjectGUID, SID or SamAccountName.

    .PARAMETER RequestFile
        Specifies the full path to the Offline Domain Join Request file to create.

    .PARAMETER DomainController
        Specifies the Active Directory Domain Services instance to connect to perform the task.

    .PARAMETER Credential
        Specifies the user account credentials to use to perform the task.

    .PARAMETER RestoreFromRecycleBin
        Try to restore the organizational unit from the recycle bin before
        creating a new one.

    .PARAMETER EnabledOnCreation
        Specifies if the computer account is created enabled or disabled.
        By default the Enabled property of the computer account will be set to
        the default value of the cmdlet New-ADComputer. This property is ignored
        if the parameter RequestFile is specified in the same configuration.
        This parameter does not enforce the property `Enabled`. To enforce the
        property `Enabled` see the resource ADObjectEnabledState.
#>
function Test-TargetResource
{
    [CmdletBinding()]
    [OutputType([System.Boolean])]
    param
    (
        # Common Name
        [Parameter(Mandatory = $true)]
        [System.String]
        $ComputerName,

        [Parameter()]
        [ValidateSet('Present', 'Absent')]
        [System.String]
        $Ensure = 'Present',

        [Parameter()]
        [ValidateNotNull()]
        [System.String]
        $UserPrincipalName,

        [Parameter()]
        [ValidateNotNull()]
        [System.String]
        $DisplayName,

        [Parameter()]
        [ValidateNotNull()]
        [System.String]
        $Path,

        [Parameter()]
        [ValidateNotNull()]
        [System.String]
        $Location,

        [Parameter()]
        [ValidateNotNull()]
        [System.String]
        $DnsHostName,

        [Parameter()]
        [ValidateNotNull()]
        [System.String[]]
        $ServicePrincipalNames,

        [Parameter()]
        [ValidateNotNull()]
        [System.String]
        $Description,

        [Parameter()]
        [ValidateNotNull()]
        [System.String]
        $Manager,

        [Parameter()]
        [ValidateNotNull()]
        [System.String]
        $RequestFile,

        [Parameter()]
        [ValidateNotNull()]
        [System.String]
        $DomainController,

        [Parameter()]
        [ValidateNotNull()]
        [System.Management.Automation.PSCredential]
        [System.Management.Automation.CredentialAttribute()]
        $Credential,

        [Parameter()]
        [ValidateNotNull()]
        [System.Boolean]
        $RestoreFromRecycleBin,

        [Parameter()]
        [ValidateNotNull()]
        [System.Boolean]
        $EnabledOnCreation
    )

    Write-Verbose -Message (
        $script:localizedData.TestConfiguration -f $ComputerName
    )

    $getTargetResourceParameters = @{
        ComputerName          = $ComputerName
        RequestFile           = $RequestFile
        DomainController      = $DomainController
        Credential            = $Credential
        RestoreFromRecycleBin = $RestoreFromRecycleBin
        EnabledOnCreation     = $EnabledOnCreation
    }

    # Need the @() around this to get a new array to enumerate.
    @($getTargetResourceParameters.Keys) |
        ForEach-Object {
            if (-not $PSBoundParameters.ContainsKey($_))
            {
                $getTargetResourceParameters.Remove($_)
            }
        }

    $getTargetResourceResult = Get-TargetResource @getTargetResourceParameters

    $testTargetResourceReturnValue = $true

    if ($Ensure -eq 'Absent')
    {
        if ($getTargetResourceResult.Ensure -eq 'Present')
        {
            Write-Verbose -Message (
                $script:localizedData.ComputerAccountShouldBeAbsent -f $ComputerName
            )

            $testTargetResourceReturnValue = $false
        }
    }
    else
    {
        if ($getTargetResourceResult.Ensure -eq 'Absent')
        {
            Write-Verbose -Message (
                $script:localizedData.ComputerAccountShouldBePresent -f $ComputerName
            )

            $testTargetResourceReturnValue = $false
        }
        else
        {
            <#
                - Ignores the parameter ComputerName since we are not supporting
                  renaming a computer account.
                - Ignore to compare the parameter ServicePrincipalNames here
                  because it needs a special comparison, so it is handled
                  afterwards.
                - Ignores the Enabled property because it is not enforced in this
                  resource.
            #>
            $compareTargetResourceStateParameters = @{
                CurrentValues    = $getTargetResourceResult
                DesiredValues    = $PSBoundParameters
                # This gives an array of properties to compare.
                Properties       = $script:computerObjectPropertyMap.ParameterName
                # But these properties
                IgnoreProperties = @(
                    'ComputerName'
                    'ServicePrincipalNames'
                    'Enabled'
                )
            }

            $compareTargetResourceStateResult = Compare-ResourcePropertyState @compareTargetResourceStateParameters

            if ($false -in $compareTargetResourceStateResult.InDesiredState)
            {
                $testTargetResourceReturnValue = $false
            }

            if ($PSBoundParameters.ContainsKey('ServicePrincipalNames'))
            {
                $testServicePrincipalNamesParameters = @{
                    ExistingServicePrincipalNames = $getTargetResourceResult.ServicePrincipalNames
                    ServicePrincipalNames         = $ServicePrincipalNames
                }

                $testTargetResourceReturnValue = Test-ServicePrincipalNames @testServicePrincipalNamesParameters
            }
        }

    }

    if ($testTargetResourceReturnValue)
    {
        Write-Verbose -Message ($script:localizedData.ComputerAccountInDesiredState -f $ComputerName)
    }
    else
    {
        Write-Verbose -Message ($script:localizedData.ComputerAccountNotInDesiredState -f $ComputerName)
    }

    return $testTargetResourceReturnValue
}

<#
    .SYNOPSIS
        Creates, removes or modifies the Active Directory computer account.

    .PARAMETER ComputerName
         Specifies the name of the Active Directory computer account to manage.
         You can identify a computer by its distinguished name, GUID, security
         identifier (SID) or Security Accounts Manager (SAM) account name.

    .PARAMETER Ensure
        Specifies whether the computer account is present or absent.
        Valid values are 'Present' and 'Absent'. The default is 'Present'.

    .PARAMETER UserPrincipalName
        Specifies the UPN assigned to the computer account.

    .PARAMETER DisplayName
        Specifies the display name of the computer.

    .PARAMETER Path
        Specifies the X.500 path of the container where the computer is located.

    .PARAMETER Location
        Specifies the location of the computer, such as an office number.

    .PARAMETER DnsHostName
        Specifies the fully qualified domain name (FQDN) of the computer.

    .PARAMETER ServicePrincipalNames
        Specifies the service principal names for the computer account.

    .PARAMETER Description
        Specifies a description of the computer account.

    .PARAMETER Manager
        Specifies the user or group Distinguished Name that manages the computer
        account. Valid values are the user's or group's DistinguishedName,
        ObjectGUID, SID or SamAccountName.

    .PARAMETER RequestFile
        Specifies the full path to the Offline Domain Join Request file to create.

    .PARAMETER DomainController
        Specifies the Active Directory Domain Services instance to connect to perform the task.

    .PARAMETER Credential
        Specifies the user account credentials to use to perform the task.

    .PARAMETER RestoreFromRecycleBin
        Try to restore the organizational unit from the recycle bin before
        creating a new one.

    .PARAMETER EnabledOnCreation
        Specifies if the computer account is created enabled or disabled.
        By default the Enabled property of the computer account will be set to
        the default value of the cmdlet New-ADComputer. This property is ignored
        if the parameter RequestFile is specified in the same configuration.
        This parameter does not enforce the property `Enabled`. To enforce the
        property `Enabled` see the resource ADObjectEnabledState.
#>
function Set-TargetResource
{
    [CmdletBinding()]
    param
    (
        [Parameter(Mandatory = $true)]
        [System.String]
        $ComputerName,

        [Parameter()]
        [ValidateSet('Present', 'Absent')]
        [System.String]
        $Ensure = 'Present',

        [Parameter()]
        [ValidateNotNull()]
        [System.String]
        $UserPrincipalName,

        [Parameter()]
        [ValidateNotNull()]
        [System.String]
        $DisplayName,

        [Parameter()]
        [ValidateNotNull()]
        [System.String]
        $Path,

        [Parameter()]
        [ValidateNotNull()]
        [System.String]
        $Location,

        [Parameter()]
        [ValidateNotNull()]
        [System.String]
        $DnsHostName,

        [Parameter()]
        [ValidateNotNull()]
        [System.String[]]
        $ServicePrincipalNames,

        [Parameter()]
        [ValidateNotNull()]
        [System.String]
        $Description,

        [Parameter()]
        [ValidateNotNull()]
        [System.String]
        $Manager,

        [Parameter()]
        [ValidateNotNull()]
        [System.String]
        $RequestFile,

        [Parameter()]
        [ValidateNotNull()]
        [System.String]
        $DomainController,

        [Parameter()]
        [ValidateNotNull()]
        [System.Management.Automation.PSCredential]
        [System.Management.Automation.CredentialAttribute()]
        $Credential,

        [Parameter()]
        [ValidateNotNull()]
        [System.Boolean]
        $RestoreFromRecycleBin,

        [Parameter()]
        [ValidateNotNull()]
        [System.Boolean]
        $EnabledOnCreation
    )

    $getTargetResourceParameters = @{
        ComputerName          = $ComputerName
        RequestFile           = $RequestFile
        DomainController      = $DomainController
        Credential            = $Credential
        RestoreFromRecycleBin = $RestoreFromRecycleBin
        EnabledOnCreation     = $EnabledOnCreation
    }

    # Need the @() around this to get a new array to enumerate.
    @($getTargetResourceParameters.Keys) |
        ForEach-Object {
            if (-not $PSBoundParameters.ContainsKey($_))
            {
                $getTargetResourceParameters.Remove($_)
            }
        }

    $getTargetResourceResult = Get-TargetResource @getTargetResourceParameters

    if ($Ensure -eq 'Present')
    {
        if ($getTargetResourceResult.Ensure -eq 'Absent')
        {
            $restorationSuccessful = $false

            # Try to restore computer account from recycle bin if it exists.
            if ($RestoreFromRecycleBin)
            {
                Write-Verbose -Message (
                    $script:localizedData.RestoringComputerAccount -f $ComputerName
                )

                $restoreADCommonObjectParameters = Get-ADCommonParameters @PSBoundParameters
                $restoreADCommonObjectParameters['ObjectClass'] = 'Computer'
                $restoreADCommonObjectParameters['ErrorAction'] = 'Stop'

                $restorationSuccessful = Restore-ADCommonObject @restoreADCommonObjectParameters
            }

            if (-not $RestoreFromRecycleBin -or ($RestoreFromRecycleBin -and -not $restorationSuccessful))
            {
                <#
                    The computer account does not exist, or the computer account
                    was not present in recycle bin, so the computer account needs
                    to be created.
                #>

                if ($RequestFile)
                {
                    <#
                        Use DJOIN to create the computer account as well as the
                        Offline Domain Join (ODJ) request file.
                    #>

                    # This should only be performed on a Domain Member, so detect the Domain Name.
                    $domainName = Get-DomainName

                    Write-Verbose -Message (
                        $script:localizedData.CreateOfflineDomainJoinRequest -f $RequestFile, $ComputerName, $domainName
                    )

                    $dJoinArguments = @(
                        '/PROVISION'
                        '/DOMAIN',
                        $domainName
                        '/MACHINE',
                        $ComputerName
                    )

                    if ($PSBoundParameters.ContainsKey('Path'))
                    {
                        $dJoinArguments += @(
                            '/MACHINEOU',
                            $Path
                        )
                    }

                    if ($PSBoundParameters.ContainsKey('DomainController'))
                    {
                        $dJoinArguments += @(
                            '/DCNAME',
                            $DomainController
                        )
                    }

                    $dJoinArguments += @(
                        '/SAVEFILE',
                        $RequestFile
                    )

                    $startProcessParameters = @{
                        FilePath     = 'djoin.exe'
                        ArgumentList = $dJoinArguments
                        Timeout      = 300
                    }

                    $dJoinProcessExitCode = Start-ProcessWithTimeout @startProcessParameters

                    if ($dJoinProcessExitCode -ne 0)
                    {
                        $errorMessage = $script:localizedData.FailedToCreateOfflineDomainJoinRequest -f $ComputerName, $dJoinProcessExitCode
                        New-InvalidOperationException -Message $errorMessage
                    }
                    else
                    {
                        Write-Verbose -Message (
                            $script:localizedData.CreatedOfflineDomainJoinRequestFile -f $RequestFile
                        )
                    }
                }
                else
                {
                    $newADComputerParameters = Get-ADCommonParameters @PSBoundParameters -UseNameParameter

                    if ($PSBoundParameters.ContainsKey('Path'))
                    {
                        Write-Verbose -Message (
                            $script:localizedData.CreateComputerAccountInPath -f $ComputerName, $Path
                        )

                        $newADComputerParameters['Path'] = $Path
                    }
                    else
                    {
                        Write-Verbose -Message (
                            $script:localizedData.CreateComputerAccount -f $ComputerName
                        )
                    }

                    <#
                        If the parameter EnabledOnCreation is specified, then the
                        property Enabled is set to that value.
                    #>
                    if ($PSBoundParameters.ContainsKey('EnabledOnCreation'))
                    {
                        if ($EnabledOnCreation)
                        {
                            Write-Verbose -Message ($script:localizedData.EnabledComputerAccount -f $ComputerName)
                        }
                        else
                        {
                            Write-Verbose -Message ($script:localizedData.DisabledComputerAccount -f $ComputerName)
                        }

                        $newADComputerParameters['Enabled'] = $EnabledOnCreation
                    }

                    New-ADComputer @newADComputerParameters
                }
            }

            <#
                Now retrieve the newly created computer account so the other
                properties can be set if specified.
            #>
            $getTargetResourceResult = Get-TargetResource @getTargetResourceParameters
        }

        <#
            - Ignores the parameter ComputerName since we are not supporting
              renaming a computer account.
            - Ignore to compare the parameter ServicePrincipalNames here
              because it needs a special comparison, so it is handled
              afterwards.
            - Ignores the Enabled property because it is not enforced in this
              resource.
        #>
        $compareTargetResourceStateParameters = @{
            CurrentValues    = $getTargetResourceResult
            DesiredValues    = $PSBoundParameters
            # This gives an array of properties to compare.
            Properties       = $script:computerObjectPropertyMap.ParameterName
            # But these properties
            IgnoreProperties = @(
                'ComputerName'
                'ServicePrincipalNames'
                'Enabled'
            )
        }

        $compareTargetResourceStateResult = Compare-ResourcePropertyState @compareTargetResourceStateParameters

        if ($PSBoundParameters.ContainsKey('ServicePrincipalNames'))
        {
            $testServicePrincipalNamesParameters = @{
                ExistingServicePrincipalNames = $getTargetResourceResult.ServicePrincipalNames
                ServicePrincipalNames         = $ServicePrincipalNames
            }

            $compareTargetResourceStateResult += @{
                ParameterName  = 'ServicePrincipalNames'
                Expected       = $testServicePrincipalNamesParameters.ServicePrincipalNames
                Actual         = $testServicePrincipalNamesParameters.ExistingServicePrincipalNames
                InDesiredState = Test-ServicePrincipalNames @testServicePrincipalNamesParameters
            }
        }

        $commonParameters = Get-ADCommonParameters @PSBoundParameters

        if ($compareTargetResourceStateResult.Where( { $_.ParameterName -eq 'Path' -and -not $_.InDesiredState }))
        {
            <#
                Must move the computer account since we can't simply
                update the DistinguishedName property

                It does not work moving the computer account using the
                SamAccountName as the identity, so using the property
                DistinguishedName instead.
            #>
            $moveADObjectParameters = $commonParameters.Clone()
            $moveADObjectParameters['Identity'] = $getTargetResourceResult.DistinguishedName

            Write-Verbose -Message (
                $script:localizedData.MovingComputerAccount -f $ComputerName, $getTargetResourceResult.Path, $Path
            )

            Move-ADObject @moveADObjectParameters -TargetPath $Path
        }

        $replaceComputerProperties = @{ }
        $removeComputerProperties = @{ }

        # Get all properties, other than Path, that is not in desired state.
        $propertiesNotInDesiredState = $compareTargetResourceStateResult |
            Where-Object -FilterScript {
                $_.ParameterName -ne 'Path' -and -not $_.InDesiredState
            }

        foreach ($property in $propertiesNotInDesiredState)
        {
            $computerAccountPropertyName = ($script:computerObjectPropertyMap |
                    Where-Object -FilterScript {
                        $_.ParameterName -eq $property.ParameterName
                    }).PropertyName

            if (-not $computerAccountPropertyName)
            {
                $computerAccountPropertyName = $property.ParameterName
            }

            if ($property.Expected)
            {
                Write-Verbose -Message (
                    $script:localizedData.UpdatingComputerAccountProperty -f $computerAccountPropertyName, ($property.Expected -join ''',''')
                )

                # Replace the current value.
                $replaceComputerProperties[$computerAccountPropertyName] = $property.Expected
            }
            else
            {
                Write-Verbose -Message (
                    $script:localizedData.RemovingComputerAccountProperty -f $property.ParameterName, ($property.Actual -join ''',''')
                )

                # Remove the current value since the desired value is empty or nothing.
                $removeComputerProperties[$computerAccountPropertyName] = $property.Actual
            }
        }

        $setADComputerParameters = $commonParameters.Clone()

        # Set-ADComputer is only called if we have something to change.
        if ($replaceComputerProperties.Count -gt 0 -or $removeComputerProperties.Count -gt 0)
        {
            if ($replaceComputerProperties.Count -gt 0)
            {
                $setADComputerParameters['Replace'] = $replaceComputerProperties
            }
            if ($removeComputerProperties.Count -gt 0)
            {
                $setADComputerParameters['Remove'] = $removeComputerProperties
            }

            Set-DscADComputer -Parameters $setADComputerParameters

            Write-Verbose -Message (
                $script:localizedData.UpdatedComputerAccount -f $ComputerName
            )
        }
    }
    elseif ($Ensure -eq 'Absent' -and $getTargetResourceResult.Ensure -eq 'Present')
    {
        # User exists and needs removing
        Write-Verbose -Message (
            $script:localizedData.RemovingComputerAccount -f $ComputerName
        )

        $removeADComputerParameters = Get-ADCommonParameters @PSBoundParameters
        $removeADComputerParameters['Confirm'] = $false

        Remove-ADComputer @removeADComputerParameters |
            Out-Null
    }
}

<#
    .SYNOPSIS
        This evaluates the service principal names current state against the
        desired state.

    .PARAMETER ExistingServicePrincipalNames
        An array of existing service principal names that should be compared
        against the array in parameter ServicePrincipalNames.

    .PARAMETER ServicePrincipalNames
        An array of the desired service principal names that should be compared
        against the array in parameter ExistingServicePrincipalNames.
#>
function Test-ServicePrincipalNames
{
    param
    (
        [Parameter(Mandatory = $true)]
        [AllowEmptyCollection()]
        [System.String[]]
        $ExistingServicePrincipalNames,

        [Parameter(Mandatory = $true)]
        [AllowEmptyCollection()]
        [AllowEmptyString()]
        [System.String[]]
        $ServicePrincipalNames

    )

    $testServicePrincipalNamesReturnValue = $true

    $testMembersParameters = @{
        ExistingMembers = $ExistingServicePrincipalNames
        Members         = $ServicePrincipalNames
    }

    if (-not (Test-Members @testMembersParameters))
    {
        Write-Verbose -Message (
            $script:localizedData.ServicePrincipalNamesNotInDesiredState `
                -f ($ExistingServicePrincipalNames -join ','), ($ServicePrincipalNames -join ',')
        )

        $testServicePrincipalNamesReturnValue = $false
    }
    else
    {
        Write-Verbose -Message (
            $script:localizedData.ServicePrincipalNamesInDesiredState
        )
    }

    return $testServicePrincipalNamesReturnValue
}

Export-ModuleMember -Function *-TargetResource