powershell - Powershell, filters and combining properties

Question

I have an AD group that has other AD groups as members. Some of these groups may have "sub-groups" as well. I want to recursively descend through this group and find answers to several questions about the users in that group. For example:

• Is User-X "enabled" in the overall group?
• Does the account of User-X have values in ANY of the properties: AccountExpirationDate, accountExpires and Deleted?

I would like a displayed result that contains the properties: DisplayName, SamAccountName, AccountExpirationDate, accountExpires, Deleted and enabled (from the group object)

I have tried doing an "Add-Member" to insert the "enabled" value from get-ADgroupMember but I get the error:

Add-Member : Cannot add a member with the name "enabled" because a member with that name already exists. If you want to over
write the member anyway, use the Force parameter to overwrite it.

... but there is no such element as far as I can tell. I have renamed the member in the Add-Member to several very unique things but I still get the same error.

my current attempt is:

Import-Module ActiveDirectory

get-adgroupmember -Identity "My big AD group of groups" -recursive |
    Where-Object -FilterScript {($_.ObjectClass -eq 'user')} |
    ForEach-Object {
        $enabled = $_.enebled
        Get-ADUser `
            -Filter {(name -eq $_.name)} `
            -Properties DisplayName,SamAccountName,AccountExpirationDate,accountExpires,Deleted |
            Add-Member -Name "myITGGroupEnabled" -Value $enabled -MemberType NoteProperty |
            Where-Object `
                -FilterScript {
                    ($_.AccountExpirationDate -lt [datetime]::now) `
                    -OR ($_.accountExpires -eq $true) `
                    -OR ($_.Deleted -eq $true) `
                    -OR ($_.myITGGroupEnabled -eq $false)
                }
            Select-Object DisplayName,SamAccountName,AccountExpirationDate,accountExpires,Deleted,GroupEnabled
        break
    }

I am lost. Ideas?

Answer 1

我认为你所需要的只是一个新的 PSObject。像这样：

    ...
    Get-AdUser -Filter {name -eq $_.name} -Properties ....  | % { 
     If  ( ($_.AccountExpirationDate -lt [datetime]::now) `
                    -OR ($_.accountExpires -eq $true) `
                    -OR ($_.Deleted -eq $true) `
                    -OR ($_.myITGGroupEnabled -eq $false)) { 

       New-Object PSObject -Property @{MyITGGRoupEnabled=$enabled}
     }           
    }