title: Unusual results in PowerShell for loop
body: <p>I have the following module.</p>
  
  <p>I've obsfucated the hashtable to protect sensitive information, but it has a bunch of values that define a domain controller, DN of the domain, domain specific username etc:</p>
  
  <pre><code>function set-domparams {
      Param(
          [Parameter(Mandatory = $true,Position=0)]
          [string]$domain,
          [Parameter(Mandatory = $true,Position=1)]
          [string[]]$username,
          [Alias("pass","p")]
          [Parameter(Mandatory = $false,Position=2)]
          $password,
          [Parameter(Mandatory = $true,Position=3)]
          [ValidateSet("Y","N")]
          [string]$cyberArk
      )
  
      Invoke-Expression -Command:'cmd.exe /c klist purge' | Out-Null
  
      function Get-Creds($domain,$user,$password) {
          if (!($password)) {$password = Read-Host "Enter $domain password" -AsSecureString}
          Invoke-Expression -Command:'cmd.exe /c klist purge' | Out-Null
          $creds = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $username,$password
          return $creds
      }
  
      $doms = @{
          'domain1.com' = @{'serverDC' = "somesvalidDC.fqdn.com";'searchBase' = "DC=somesvalidDC,DC=fqdn,DC=com";'suffix' = "domain1.com"; 'TSMserver' = "127.0.0.1"; 'NetBIOS' = "domain1"; 'SCOM' = "somescomserver.com";'AdminSuffix' = "_admin"}
          'domain2.com' = @{'serverDC' = "somesvalidDC.fqdn.com";'searchBase' = "DC=somesvalidDC,DC=fqdn,DC=com";'suffix' = "domain2.com"; 'TSMserver' = "127.0.0.1"; 'NetBIOS' = "domain2"; 'SCOM' = "somescomserver.com";'AdminSuffix' = ".adm"}
      }
  
      if ((!$cyberArk) -or ($cyberArk -eq 'N')) {
          $global:fetchCreds = Get-Creds -domain $domain -user $username -password $password
      } else {
          $CyberArkUser = "cyberarkdom\" + $username
          $CyberArkdomain = 'cyberarkdom.int'
          $global:fetchCreds = Get-Creds -domain $CyberArkdomain -user $CyberArkUser -password $password
      }
  
      $global:adminsuffix = $doms.$domain.AdminSuffix
      $global:user = $doms.$domain.NetBIOS + "\" + $username + $adminsuffix
      $global:dc = $doms.$domain.serverDC
      $global:DomNBT = $doms.$domain.NetBIOS
      $global:searchbase = $doms.$domain.searchBase
      $global:suffix = $doms.$domain.suffix
      $global:TSMserver = $doms.$domain.TSMserver
      $global:scom = $doms.$domain.scom
  }
  </code></pre>
  
  <p>I have used this numerous times in scripts and it works, but am currently having an odd problem when attempting an operation against multiple domains in a new script:</p>
  
  <pre><code>Param(
      [Parameter(Mandatory = $true)]
      [ValidateSet("Y","N")]
      [string]$cyberArk
  )
  
  $userprompt = Read-Host "Enter username"
  $userpass = Read-Host "Enter $domain password" -AsSecureString
  
  $domainlist = @('domain1.fqdn.co', 'anotherdomain.com', 'differesntforest3.com.au')
  
  foreach ($domain in $domainlist) {
      $results = ""
      set-domparams -domain $domain -username $userprompt -password $userpass -cyberArk $cyberArk
  
      $results = Get-ADGroup -Server $DC -Credential $fetchCreds -Filter * |
                 where {$_.Name -like "*-DelAdmin-Servers*"} |
                 select Name, SamAccountName
      foreach ($result in $results) {
          [PSCustomObject]@{
              Name = $result.Name
              domain = $domain
              samaccountname = $result.SamAccountName
          }
      }
  }
  </code></pre>
  
  <p>I get the following error when the domain list contains domains across different forests (password is consistent across domains):</p>
  
  <pre>
  Get-ADGroup : The server has rejected the client credentials.
  At E:\Scripts\get-testrun.ps1:16 char:16
  + ...  $results = Get-ADGroup -Server $DC -Credential $fetchCreds -Filter * ...
  +                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      + CategoryInfo          : SecurityError: (:) [Get-ADGroup], AuthenticationException
      + FullyQualifiedErrorId : ActiveDirectoryCmdlet:System.Security.Authentication.AuthenticationException,Microsoft.ActiveDirectory.Management.Commands.GetADGroup
  </pre>
  
  <p>If run as a one liner against any of these domains individually, the module works and authenticates fine, returning all of the global variables and performing the query in the script without error.</p>
  
  <p>What am I missing?</p>