Question

我需要提取一个组的所有成员，然后将其格式化为Names，所以我只得到像＃Joe; Don Joe＆＃34;是my-domain \ UNCShareDrive

的成员

在导出ACL列表后，我需要将其显示在我的CSV中。

例如：

Path                                                                 FileSystemRights AccessControlType IdentityReference          
----                                                                 ---------------- ----------------- -----------------          
Microsoft.PowerShell.Core\FileSystem::\\fileshare\management\DK           FullControl             Allow MY-DOMAIN\Drev Management
Microsoft.PowerShell.Core\FileSystem::\\fileshare\management\           FullControl             Allow BUILTIN\Administratorer    
Microsoft.PowerShell.Core\FileSystem::\\fileshare\management\     FullControl             Allow MY-DOMAIN\Drev Management
Microsoft.PowerShell.Core\FileSystem::\\fileshare\management\     FullControl             Allow BUILTIN\Administratorer    




**These persons has access to the drive:**

**Finding group:  MY-DOMAIN\Administrators** 

Name                   SamAccountName Mail                     
----                   -------------- ----                     
Administrator          Administrator  Administrator@my-domain.dk

这是我迄今为止在Powershell中所做的：

$Searching = Get-ADGroup -Filter * -SearchBase "DC=my-domain,DC=local"

$mypath = "U:\mytest.csv"

if((Test-Path -Path "U:\mytest.csv" -pathtype Container) -eq $True){
  Write-Host -ForegroundColor red "We found a file: $mypath --> REMOVING!`r`n"
  Remove-Item $mypath -Force
}

$ShareName = "\\\sharename\D$"

$shares = Get-Childitem -path $ShareName |
          Where-Object {$_.PSIsContainer} |
          Get-ACL |
          Select-Object Path -ExpandProperty Access |
          Select Path, FileSystemRights,AccessControlType,IdentityReference |
          export-csv $mypath -Delimiter ';' -NoTypeInformation -Encoding UTF8
$foldertotal = 0
Add-Content $mypath "" 
Add-Content $mypath "" 
Add-Content $mypath "Disse personer har adgang til share navnet"
Add-Content $mypath "" 
Add-Content $mypath ""

$myLoop = ''
foreach ($testLoop in $myLoop) {
  $Group = Get-ADGroup -Filter * -SearchBase "DC=my-domain,DC=local" -Properties IdentityReference |
           Select-Object Name # Need only groups in $Shares - who are displayed
  $myLoop += Write-Host -ForegroundColor Yellow "Finding group: $($Group.name).....`n"
  $myLoop += ForEach ($Group in $share) {
               Get-ADGroupMember -identity $($Group.name) -recursive |
                 Get-ADUser -Properties Name,SamAccountName,Mail |
                 Select-Object Name,SamAccountName,Mail
             } 
  $testLoop | Out-File -filePath $mypath -append -encoding utf8
}

Write-Host -ForegroundColor Cyan "$($Group.name) is now exported to: $mypath`n"

我也很难过滤掉共享路径：

$shares.Replace('Microsoft.PowerShell.Core\FileSystem::', ' ') |
  Out-File -filePath $mypath -append -encoding utf8

当我使用用户输入而不是在没有控制台提示的情况下自动循环时，这个东西怎么工作：

$Searching = Get-ADGroup -Filter * -SearchBase "DC=MY-DOMAIN,DC=local"

$mypath = "U:\mytest.csv"
$networkPath = "\\ShareName\D$"
$acl = Get-acl -path $networkPath

if((Test-Path -Path "U:\mytest.csv" -pathtype Container) -eq $True){
  Write-Host -ForegroundColor red "We found a file: $mypath --> REMOVING!`r`n"
  Remove-Item $mypath -Force
}

Write-Host -ForegroundColor Yellow "Eksempel på share: "`r`n\\ShareName\D$`r`n\\ShareTwo\\E$`r`n\\ShareName\management`r`n""
$ShareName = Read-host "Hvilket sharenavn vil du finde Access Control List fra?"
if($ShareName -eq "1"){
  $Sharename = "\\ShareName\D$"
}
if($ShareName -eq "2"){
  $Sharename = "\\ShareTwo\\E$"
}
if($ShareName -eq "3"){
  $Sharename = "\\ShareName\management"
}

Get-Childitem -path $ShareName |
  Where-Object {$_.PSIsContainer} |
  Get-ACL |
  Select-Object Path -ExpandProperty Access |
  Select Path, FileSystemRights,AccessControlType,IdentityReference |
  FT -AutoSize |
  Out-File -Encoding utf8 $mypath
Add-Content $mypath "" 
Add-Content $mypath "" 
Add-Content $mypath "Disse personer har adgang til share navnet"
Add-Content $mypath "" 

$users = get-aduser -Filter {Name -Like "*"} -Searchbase "dc=MY-DOMAIN,dc=local" -Properties MemberOf |
         Where-Object { $_.Enabled -eq 'True' }

Write-Host -ForegroundColor red "Example:  Drev Management`r`n"
$myGroups = Read-Host "Hvilken Gruppe vil du bruge?"
if($myGroups -eq "1"){
  $myGroups = " Drev Management"
}
$Groups = Get-ADGroup -filter {Name -like $myGroups} | Select-Object Name 

Add-Content $mypath "Finding group: $($group.name)"
Write-Host -ForegroundColor Yellow "Finding group: $($Group.name).....`n"
Add-Content -Path $mypath $result

ForEach ($Group in $Groups) {
  Get-ADGroupMember -identity $($Group.name) -recursive |
    Get-ADUser -Properties Name,SamAccountName,Mail |
    Select-Object Name,SamAccountName,Mail |
    FT -AutoSize |
    Out-File -Append -encoding utf8 $mypath
}
Write-Host -ForegroundColor Cyan "$($Group.name) is now exported to: $mypath`n"

Answer 1

您的第二个代码示例有效，因为它没有出现与第一个相同的错误。

$myLoop = ''
foreach ($testLoop in $myLoop) {
  $Group = Get-ADGroup -Filter * ...
  $myLoop += Write-Host ...
  $myLoop += ForEach ($Group in $share) {
               Get-ADGroupMember ...
             } 
  $testLoop | Out-File -filePath $mypath -append -encoding utf8
}

你使$myLoop成为一个空字符串，然后迭代$myLoop的每个元素（一个空字符串），这样你得到一个循环周期，无论你附加到$myLoop的是什么里面循环。
而不是组成员，您将$testLoop（空字符串）的内容写入输出文件。
您将AD组读入变量$Group，然后在$Group中使用foreach ($Group in $share)作为循环变量时覆盖其内容。
$share是emtpy，因为它从未在任何地方初始化。即使$shares为空，因为当您将ACL信息写入CSV时，不会留下可以分配给变量的输出。

作为旁注：您无法将Write-Host输出附加到任何内容，因为cmdlet会写入主机进程（即控制台），而不是可以捕获或重定向的流。

您需要在$shares中捕获ACL信息，然后再将其写入文件：

$shares = Get-Childitem -Path $ShareName |
          Where-Object {$_.PSIsContainer} |
          Get-ACL |
          Select-Object Path -ExpandProperty Access |
          Select Path, FileSystemRights,AccessControlType,IdentityReference
$shares | Export-Csv $mypath -Delimiter ';' -NoTypeInformation -Encoding UTF8

然后，您可以确定有权访问此类共享的组的成员：

$shares | Select-Object -Expand IdentityReference |
  Select-Object -Expand Value |
  ForEach-Object {
    $name = $_ -replace '^DOMAIN\\'  # <-- replace with actual domain name
    Get-ADObject -Filter { Name -eq $name }
  } |
  Where-Object { $_.ObjectClass -eq 'group' } |
  Get-ADGroupMember |
  Get-ADUser -Properties * |
  Select-Object Name, SamAccountName, Mail |
  Out-File $mypath -Append -Encoding UTF8

请注意，这不会解析嵌套组，也不会区分共享。

如果要存储组名及其成员，则需要向管道添加循环：

$shares | Select-Object -Expand IdentityReference |
  Select-Object -Expand Value |
  ForEach-Object {
    $name = $_ -replace '^DOMAIN\\'  # <-- replace with actual domain name
    Get-ADObject -Filter { Name -eq $name }
  } |
  Where-Object { $_.ObjectClass -eq 'group' } |
  ForEach-Object {
    $_
    Get-ADGroupMember -Identity $_ |
      Get-ADUser -Properties * |
      Select-Object Name, SamAccountName, Mail
  } |
  Out-File $mypath -Append -Encoding UTF8

从Get-Acl获取组成员名称并附加到CSV

1 个答案: