powershell - 如何使用 powershell 使 AD 组成为另一个 AD 组的成员？

Question

我正在尝试制作批量脚本来创建组并使某些组成为另一个组（子组）的成员。我想创建组 TestGroup1,TestGroup2 (memberOf TestGroup1),TestGroup3 (memberOf TestGroup1)

所以这是我的包含输入组的 csv 文件：

bulk_import.csv：

GroupName,GroupType,GroupLocation,Member

TestGroup1,Global,"OU=arSearch",
TestGroup2,Global,"OU=arSearch",TestGroup1
TestGroup3,Global,"OU=arSearch",TestGroup1

创建组的脚本如下：

bulk_ad_group_creation.ps1

Import-Module ActiveDirectory
#Import CSV
$csv = @()
$csv = Import-Csv -Path "C:\bulk_import.csv"

#Get Domain Base
$searchbase = Get-ADDomain | ForEach {  $_.DistinguishedName }

#Loop through all items in the CSV
ForEach ($item In $csv)
{
  #Check if the OU exists
  $check = [ADSI]::Exists("LDAP://$($item.GroupLocation),$($searchbase)")

  If ($check -eq $True)
  {
    Try
    {
      #Check if the Group already exists
      $exists = Get-ADGroup $item.GroupName
      Write-Host "Group $($item.GroupName) alread exists! Group creation skipped!"
    }
    Catch
    {
      #Create the group if it doesn't exist
      $create = New-ADGroup -Name $item.GroupName -GroupScope $item.GroupType -Path ($($item.GroupLocation)+","+$($searchbase)) -Member $item.Member
      Write-Host "Group $($item.GroupName) created!"
    }
  }
  Else
  {
    Write-Host "Target OU can't be found! Group creation skipped!"
  }
}

但它总是打印出参数 -Member 找不到，请指教。

我正在使用 Windows Server 2008 R2。

Answer 1

我能够通过如下更改脚本来解决它：

Import-Module ActiveDirectory
#Import CSV
$csv = @()
$csv = Import-Csv -Path "C:\bulk_import.csv"

#Get Domain Base
$searchbase = Get-ADDomain | ForEach {  $_.DistinguishedName }



#Loop through all items in the CSV
ForEach ($item In $csv)
{
  #Check if the OU exists
  $check = [ADSI]::Exists("LDAP://$($item.GroupLocation),$($searchbase)")

  If ($check -eq $True)
  {
    Try
    {
      #Check if the Group already exists
      $exists = Get-ADGroup $item.GroupName
      Write-Host "Group $($item.GroupName) alread exists! Group creation skipped!"
    }
    Catch
    {
      #Create the group if it doesn't exist
      $create = New-ADGroup -Name $item.GroupName -GroupScope $item.GroupType -Path ($($item.GroupLocation)+","+$($searchbase))
      Write-Host "Group $($item.GroupName) created!"
      if($item.MemberOf -eq ""){
         Write-Host "Group don't have parent"
         }else{
             Add-ADGroupMember -Identity $item.MemberOf -Member $item.GroupName 
           }
    }
  }
  Else
  {
    Write-Host "Target OU can't be found! Group creation skipped!"
  }
}