1

所以下面是我关于如何跨受信任域调用组中的递归成员的脚本。我需要帮助的是将其从查找单个组转换为多个组。

在这条线上，$objGrp = [ADSI]"LDAP://CN=Administrators,CN=Builtin,DC=domain,DC=com"我必须手动将其更改为我想要搜索的任何组。相反，我希望此脚本调用包含组列表的文本文件。

例如，在文本文件中会有

CN=Administrators,CN=Builtin,DC=domain,DC=com
CN=domain admins,CN=users,DC=domain,DC=com
CN=enterprise admins,CN=users,DC=domain,DC=com

我需要添加/更改什么才能做到这一点？

# Script begins
#
# Bind to the AD group
$objGrp = [ADSI]"LDAP://CN=Administrators,CN=Builtin,DC=domain,DC=com"
#[ADSI]"LDAP://CN=Administrators,CN=Builtin,DC=domain,DC=com"
#

$Global:GroupMembers = @()

# Function to read the group members - nested members
Function GetGroupMember($objGrp)
{
# Enumerate the group members
foreach($member in $objGrp.member)
{
    # Bind to the each user using DN
    $strTemp = "LDAP://" + $member
    $objTemp = [ADSI]$strTemp

        # Check for AD Group object based on objectCategory
        $strCat = [System.String]$objTemp.objectCategory
    #foreign object

    $res = $strCat.StartsWith("CN=Foreign-Security-Principal")

    #$strCat
    If($res -eq $True)
    {

                # bind to the foreign object
    $strTemp = "LDAP://" + $member
    $tempObj = [ADSI]$strTemp
    # convert binary SID to bindable string SID
    $objBin = $tempObj.objectSID.Item(0)
    $objSID = New-Object System.Security.Principal.SecurityIdentifier($objBin,0)


    $srchDomain = New-Object System.DirectoryServices.DirectoryEntry("LDAP://dc=domain,dc=com")
    $dirSrchObj = New-Object System.DirectoryServices.DirectorySearcher($srchDomain)


    #$objSID.Value
    [System.Environment]::NewLine
    $dirSrchObj.Filter = "((objectSID=" + $objSID.Value + "))"
    # Search scope to sub-level
    $dirSrchObj.SearchScope = "Subtree"
    $dirSrchObj.PageSize = 1
    # Array of result collection - users 
    $srchResArr = $dirSrchObj.FindOne()

    "======================================="
    If ($srchResArr -ne $NULL)
    {
        # bind to the object
        #$strTem = [System.String]$srchResArr.ToString()

        $objEntry = $srchResArr.GetDirectoryEntry()
        # read and compare the object category for group object
        [System.String]$strTemp1  = $objEntry.objectcategory
        $res1 = $strTemp1.StartsWith("CN=Group")

        if($res1 -eq $True)
        {   
            #enumerate the group members
            Write-Host "The members of foreign group " $objEntry.Name "are: "
            Foreach($obj in $objEntry.member)
            {
                $strTemp2 = "LDAP://" + $obj
                $objTemp2 = [ADSI]$strTemp2     

                [System.String]$strTemp3 = $objTemp2.objectCategory
                $res2 = $strTemp3.StartsWith("CN=Group")
                if($res2 -eq $True)
                {
                    GetGroupMember($objTemp2)
                }
                Else
                {
                    $objTemp2.distinguishedName
                    $Global:GroupMembers += $objTemp2.distinguishedName

                }
            }
        }
        Else
        {
            "Foreign user object: "
            $objEntry.distinguishedName
            $Global:GroupMembers += $objEntry.distinguishedName
        }

    }
    "======================================="
    [System.Environment]::NewLine

    }
    Else
    {


        $flag = $strCat.StartsWith("CN=Group")


        # If it is a Group object then call this method (recursive)
        If($flag -eq $TRUE)
        {
            Write-Host "++++++++++++++++++++++Recursive Call to Enumerate" $objTemp.distinguishedName
            GetGroupMember($objTemp)
            Write-Host "---------------------- End Recursive Call to Enumerate" $objTemp.distinguishedName

        }
        # If user object then display its DN
        if($flag -eq $False)
        {
            $objTemp.distinguishedName
            $Global:GroupMembers += $objTemp.distinguishedName
            #$objTemp.sAMAccountname
        }
    }
}
}
#
GetGroupMember $objGrp


""
""
"Final List:"
$Global:GroupMembers | sort -uniq | out-file c:\temp\test.csv
4

1 回答 1

1

如果您的组列表在，C:\grouplist.txt那么您可以使用Get-Content来获取名称，然后遍历它们：

$groupNames = Get-Content 'C:\grouplist.txt'

foreach($groupName in $groupNames)
{
    GetGroupMember [ADSI]$groupName
}

"Final List:"
$Global:GroupMembers | sort -uniq | out-file c:\temp\test.csv
于 2012-09-19T19:03:29.930 回答