0

我正在尝试查找指定用户帐户的组成员身份。一个域的用户帐户通常是其他域中某个组的成员（某些域需要不同的管理员帐户）。使用 get-QAQgroup，我可以成功地单独搜索每个域，但是当我尝试遍历域时，我只能在我登录的域中找到结果。#Script 更改域并查找指定用户帐户的组成员身份。

$domains = "dom1.ad.state.company.com","dom2.ad.state.company.com","dom3.ad.state.company.com","dom4.ad.state.company.com","corporate.state.company.com","OddNamedDom.com"
$CRED=GET-CREDENTIAL
$userAcc = read-host "Enter domain\username for Group Membership Search"

foreach ($domain in $domains)
  {
     write-host "In the domain $domain "," $userAcc is a direct member of..."
     Get-QADGroup -service $domain -Credential $cred -Containsmember $userAcc | select name
  } #foreach domain

Connect-QADService -Service 'dom1.ad.state.company.com'

当我运行脚本时，我得到了 dom1（我登录的域）的结果，其余的抛出以下错误。我不确定为什么“Ref 1:..”行指向“dom1”。我认为这可能是问题的根源。我复制了下面显示错误消息的 Powershell 输出。

In the domain dom1.ad.state.company.com   dom1\brownd2.admin.dom1 is a direct member of...

Name                                                                                                                                            
----                                                                                                                                        
DOM1-G-ITS-DS-Company Services                                                                                                                 
DOM1PGUELFP00003-Exmerge-R                                                                                                                   
DOMPGUELFP00003-Exmerge-C                                                                                                                   
ITSPPTBOSHFS003-FSSHARE-C                                                                                                                   
Domain Users                                                                                                                                

In the domain dom2.ad.state.company.com   dom1\brownd2.admin.dom1 is a direct member of...
Get-QADGroup : 0000202B: RefErr: DSID-03100742, data 0, 1 access points
    ref 1: 'dom1.ad.state.company.com'
At C:\TestScripts\tGet-UserAllMemberships.ps1:24 char:6
+      Get-QADGroup -service $domain -Credential $cred -Containsmember $userAcc |  ...
+      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Get-QADGroup], DirectoryAccessException
    + FullyQualifiedErrorId : Quest.ActiveRoles.ArsPowerShellSnapIn.DirectoryAccess.DirectoryAccessException,Quest.ActiveRoles.ArsPowerShel 
   lSnapIn.Powershell.Cmdlets.GetGroupCmdlet

In the domain dom3.ad.state.company.com   dom1\brownd2.admin.dom1 is a direct member of...
Get-QADGroup : 0000202B: RefErr: DSID-03100742, data 0, 1 access points
    ref 1: 'dom1.ad.state.company.com'
At C:\TestScripts\tGet-UserAllMemberships.ps1:24 char:6
+      Get-QADGroup -service $domain -Credential $cred -Containsmember $userAcc |  ...
+      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Get-QADGroup], DirectoryAccessException
    + FullyQualifiedErrorId : Quest.ActiveRoles.ArsPowerShellSnapIn.DirectoryAccess.DirectoryAccessException,Quest.ActiveRoles.ArsPowerShel 
   lSnapIn.Powershell.Cmdlets.GetGroupCmdlet

我正在检查的每个域都有一组类似的错误。我没有发布完整的错误信息列表。

如果我更改数组中域的顺序，则一个成功域的错误和结果只会更改顺序以匹配数组。我认为循环的第一次迭代可能会成功。不过不是这样。

我知道该帐户是 Dom2 中组的成员，而不是 Dom3 中的任何组中的成员。如果我从 foreach 循环中取出命令并在控制台中为每个域单独运行，我确实会得到预期的结果。根据个人结果，我认为这将是循环执行的直接示例，但我没有正确连接到域。

我能改变什么？

4

1 回答 1

0

这是使用System.DirectoryServices.AccountManagement命名空间的解决方案，适用于 C# 代码中的 PowerShell。这是一种递归解决方案。在Find Recursive Group Membership (Active Directory) using C# 中，我提供了一个递归解决方案（使用 PowerShell 1.0 中提供的基本 ADSI），它也适用于通讯组。

# Retreiving a principal context for the administrator on the Global Catalog
Add-Type -AssemblyName System.DirectoryServices.AccountManagement
$domainContext = New-Object DirectoryServices.AccountManagement.PrincipalContext([DirectoryServices.AccountManagement.ContextType]::Domain, "VMESS01:3268" , "administrator", "adminPasswd")
# Retreive the groups
try {
  $userPrincipal = [DirectoryServices.AccountManagement.UserPrincipal]::FindByIdentity($domainContext, "jpb")
  $groups = $userPrincipal.GetAuthorizationGroups()
  foreach($group in $groups)
  {
    $group.name;
  }
}
finally {
    $pc.domainContext()
}
于 2014-05-21T14:01:24.900 回答