How do you make administrative PowerShell idempotent?
Documentation: Microsoft Learn
Design scripts that compare current and desired state, change only what differs, and report repeatable administrative outcomes.
Interview · Question 13 of 34
Answer before reveal
Your draft
Write the answer you would give in an interview. The model answer stays hidden until you have drafted at least a short response.
A strong answer
An idempotent administrative operation converges on the same desired state when repeated. Start by defining what must be true, then query the current state and apply only the necessary changes. For a directory user, distinguish between an absent account, an existing account that needs an update, and an account that already matches the intended properties.
Use a stable identifier for lookup and make the comparison explicit. A successful lookup with no matching object is different from a failed lookup caused by permissions or connectivity. Never interpret an unknown state as permission to create or overwrite an object. If a change fails, preserve the error and recheck the authoritative state before deciding to retry.
Plan for partial completion and concurrent changes. Return a result per target, such as unchanged, updated, created or failed, and verify the state after a write when the operation warrants it. WhatIf support can help a reviewer understand planned changes, but does not itself make a script idempotent. Test a first run, an immediate second run, and a run after deliberately introducing drift.
