Question

我需要抓住特定AD组中的成员并将它们添加到数组中。使用net group我可以轻松获得AD组的成员。但是，我对Windows上的过滤器并不熟悉。我只想从输出中获取用户名。

Group name     test
Comment

Members

---------------------------------------------------------------------
mike                  tom                      jackie
rick                  jason                    nick
The command completed successfully.

我无法使用PowerShell使用Get-ADGroupMember命令。如果有办法使用PowerShell获取数据和过滤器，那也没关系。

Answer 1

好消息是，PowerShell中很少有一种方法可以做。这是我手边的一个更大的脚本的一部分，用于一些与群组相关的事情，我不总是有AD模块可用（例如在其他团队拥有的服务器上）：

$Identity = 'test'
$LDAP = "dc="+$env:USERDNSDOMAIN.Replace('.',',dc=')
$Filter = "(&(sAMAccountName=$Identity)(objectClass=group))"
$Searcher = [adsisearcher]$Filter
$Searcher.SearchRoot = "LDAP://$LDAP"
'Member','Description','groupType' | %{$Searcher.PropertiesToLoad.Add($_)|Out-Null}

$Results=$Searcher.FindAll()

$GroupTypeDef = @{
    1='System'
    2='Global'
    4='Domain Local'
    8='Universal'
    16='APP_BASIC'
    32='APP_QUERY'
    -2147483648='Security'
}

If($Results.Count -gt 0){
    $Group = New-Object PSObject @{
        'DistinguishedName'=[string]$Results.Properties.Item('adspath') -replace "LDAP\:\/\/"
        'Scope'=$GroupTypeDef.Keys|?{$_ -band ($($Results.properties.item('GroupType')))}|%{$GroupTypeDef.get_item($_)}
        'Description'=[string]$Results.Properties.Item('description')
        'Members'=[string[]]$Results.Properties.Item('member')|% -Begin {$Searcher.PropertiesToLoad.Clear();$Searcher.PropertiesToLoad.Add('objectClass')|Out-Null} {$Searcher.Filter = "(distinguishedName=$_)";[PSCustomObject][ordered]@{'MemberType'=$Searcher.FindAll().Properties.Item('objectClass').ToUpper()[-1];'DistinguishedName'=$_}}
    }
    $Group|Select DistinguishedName,Scope,Description
    $Group.Members|FT -AutoSize
}
Else{"Unable to find group '$Group' in '$env:USERDNSDOMAIN'.`nPlease check that you can access that domain from your current domain, and that the group exists."}

Answer 2

以下是在不使用AD cmdlet的情况下获取AD组的直接成员的一种方法：

param(
  [parameter(Mandatory=$true)]
    $GroupName
)

$ADS_ESCAPEDMODE_ON   = 2
$ADS_SETTYPE_DN       = 4
$ADS_FORMAT_X500      = 5

function Invoke-Method {
  param(
    [__ComObject] $object,
    [String] $method,
    $parameters
  )
  $output = $object.GetType().InvokeMember($method, "InvokeMethod", $null, $object, $parameters)
  if ( $output ) { $output }
}
function Set-Property {
  param(
    [__ComObject] $object,
    [String] $property,
    $parameters
  )
  [Void] $object.GetType().InvokeMember($property, "SetProperty", $null, $object, $parameters)
}

$Pathname = New-Object -ComObject "Pathname"
Set-Property $Pathname "EscapedMode" $ADS_ESCAPEDMODE_ON

$searcher = [ADSISearcher] "(&(objectClass=group)(name=$GroupName))"
$searcher.PropertiesToLoad.AddRange(@("distinguishedName"))

$searchResult = $searcher.FindOne()
if ( $searchResult ) {
  $groupDN = $searchResult.Properties["distinguishedname"][0]
  Invoke-Method $Pathname "Set" @($groupDN,$ADS_SETTYPE_DN)
  $path = Invoke-Method $Pathname "Retrieve" $ADS_FORMAT_X500
  $group = [ADSI] $path
  foreach ( $memberDN in $group.member ) {
    Invoke-Method $Pathname "Set" @($memberDN,$ADS_SETTYPE_DN)
    $path = Invoke-Method $Pathname "Retrieve" $ADS_FORMAT_X500
    $member = [ADSI] $path
    "" | Select-Object `
      @{
        Name="group_name"
        Expression={$group.name[0]}
      },
      @{
        Name="member_objectClass"
        Expression={$member.ObjectClass[$member.ObjectClass.Count - 1]}
      },
      @{
        Name="member_sAMAccountName";
        Expression={$member.sAMAccountName[0]}
      }
  }
}
else {
  throw "Group not found"
}

此版本使用Pathname COM对象处理名称转义，并为组的每个成员输出对象类和sAMAccountName。

Windows＆＃34;网络组/域名＆＃34;输出滤波器

2 个答案: