Helper method converting PSObject to string may fail

[SteveL-MSFT]

This was encountered by a MS Partner team. When calling a cmdlet that outputs lots of objects, the SmartToString() helper throws the exception "InvalidOperationException: Collection was modified after the enumerator was instantiated" as the PSObject is modified before the conversion completes. There is already code to catch an ExtendedTypeSystemException and we could extend that for any exception and just return string.empty. Or alternatively, we could make a copy of the object but that would impact perf.

In the repro, it was explicitly going through the Format-List code, although Format-Table may also use this helper.

[mklement0]

This may not be technically related, but it reminded me of #6163

[iSazonov]

If the PSObject is changed while it is enumerated it looks like a race condition in user code (how do they change it? from another runspace?) - why should we hide the exception?

[SteveL-MSFT]

@iSazonov in this specific repro, they were enumerating a large collection of AD objects and it only repro'd for them when transcription was enabled although I'm not sure that is directly related. Transcription may have just slowed it down to make the race condition happen more easily.

[iSazonov]

It looks as fundamental problem. I caught the same with AccountManagement API. It depends on a context and every call to the object causes a "remote" call to ensure that the object is live. So if such check presents in enumerator we can not resolve this exception naturally.

[HerbertMauerer]

Hello,
Redacted by @joeyaiello

The problem happens in the Active Directory Admin Center (ADAC) when there are many objects in a container. I have a customer waiting for a resolution on this. And I have the worry that additional customers run into this as they switch from the older toolset to ADAC.

I'm aware you have other deliverables. I would appreciate if you could share an ETA when you think you can start working on this problem.

Thanks

Herbert Mauerer

[vexx32]

If what @iSazonov is saying is correct, I suspect the issue can only really be resolved in the ActiveDirectory module itself.

PowerShell can attempt to mitigate the eventual effect of it, but it can't change the way the ActiveDirectory module is choosing to operate. The best we could hope for from the PowerShell end would probably be that some objects would end up quietly skipped and maybe a less intrusive error would be recorded after enumeration completes.

But even then, I'm not sure it's something PowerShell will be able to account for.

[iSazonov]

@HerbertMauerer Because ADAC is not OSS we need a simple repro like a script or GitHub shared C# project. We need to understand what API to investigate.
Perhaps you could share more information about the broken scenario. As I know ADAC limits to 20000 objects by default and max limit is 100000. Perhaps it is not right things to build so large PSObject and convert it to string.

[HerbertMauerer]

It is tough to rebuild what ADAC does. When I capture the command it sends and run the same get-adobject query, it succeeds.

Addtl. consideration:
We had a past issue where only ADAC was failing with PS transscripting enabled,:
3196545 ADDS: Admin: Active Directory Administrative Center does not work with PowerShell Transcripting
Redacted by @joeyaiello

This is the case here as well. When you turn off transscripting, it works.

[iSazonov]

I guess ADAC implements custom transcription and you could look the code - I wonder if it changes an object in the enumerator.

[HerbertMauerer]

Hello,

do you have Windows source access?
I could also hook you up with the DEV Owner of ADAC.

Herbert

[iSazonov]

No, I haven't the access.