Question

无可替代的现实我可以被视为系统管理员。相反，我支持ERP系统并使用PowerShell作为编程语言来处理BI类型的事情，因为我无法访问ERP编写的语言。所以，请忽略我对这个主题的无知这个问题。

为了使我们的ERP与工程系统保持同步，我创建了一套程序。第一个验证AD帐户用于登录PC的密码，并将其输出到文件中供以后使用。该程序适用于它开发的Windows 7机器。但是，它在Windows 10计算机上运行时会出现此错误。功能＆＃34; Test-ADCredential＆＃34;是从被拘禁者那里偷来的，不是我的。

Exception calling "ValidateCredentials" with "2" argument(s): "The server cannot handle directory requests."
At C:\GitRepo\PowerShellScripts\TeamCenter2M3AdCheck.ps1:20 char:9
+         $DS.ValidateCredentials($UserName, $Password)
+         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : DirectoryOperationException

开发机器上的PowerShell（Windows 7）：

Name                           Value
----                           -----
PSVersion                      5.1.14409.1012
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.14409.1012
CLRVersion                     4.0.30319.34209
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1

Windows 10上的版本：

Name                           Value
----                           -----
PSVersion                      5.1.15063.786
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.15063.786
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1

以下是该计划：

# TeamCenter2M3AdCheck.ps1  Verify the password for current user and pass the user/id for MDI update
#  02/05/2018

param ([string]$IniFile)

Import-Module "C:\GitRepo\PowerShellScripts\TeamCenter2M3Setup.psm1" -Force

function Test-ADCredential {
  [CmdletBinding()]
    Param ([string]$UserName,
           [string]$Password)
    if (!($UserName) -or !($Password)) {
        Write-Warning 'Test-ADCredential: Please specify both user name and password'
    } else {
        Add-Type -AssemblyName System.DirectoryServices.AccountManagement
        $DS = New-Object System.DirectoryServices.AccountManagement.PrincipalContext('domain')
        $DS.ValidateCredentials($UserName, $Password)
    }
}  # function Test-ADCredential

# Initilize globlal variables from the INI file
IniParameters -IniFile $IniFile

$PasswordFile = $TC2M3Dir + "TeamCenterPassword.csv"
[System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic') | Out-Null
[Byte[]] $Key = (1..16)

$UserId = $env:USERNAME
Do {  #loop until password is okay
    # Request the account's password
    $SecurePassword = Read-Host -AsSecureString  -Prompt "Enter password for $UserId"
    $UnsecurePassword = [Runtime.InteropServices.Marshal]::PtrToStringAuto([Runtime.InteropServices.Marshal]::SecureStringToBSTR($SecurePassword))
    $Okay = Test-ADCredential -UserName $UserId -Password $UnsecurePassword

    If ($Okay) {
      $PasswordString = ConvertFrom-SecureString -SecureString $SecurePassword -Key $Key
     $CsvText = "AdAccount,Password`n$UserId,$PasswordString"
     Out-File -FilePath $PasswordFile -InputObject $CsvText -Encoding ascii
   }
   else {
        Write-Host "Password failed.  Please try again or press Ctrl+c" -ForegroundColor Red
    }
} Until ($Okay)

提前感谢您的帮助。

Answer 1

变化：

$DS.ValidateCredentials($UserName, $Password)

要：

$DS.ValidateCredentials($UserName, $Password, [DirectoryServices.AccountManagement.ContextOptions]::Negotiate -bor [DirectoryServices.AccountManagement.ContextOptions]::Sealing)

基本上，在新机器上，它可能会回到尝试使用基本身份验证，而不是使用＆＃34; Negotiate＆＃34; （即使用Kerberos或NTLM加密与AD的连接）以进行验证。通过显式设置Context选项以强制Negotiate或Sealing（另一种加密变体），这应该可以解决问题。

我确认我能够让代码在Windows 10上运行。

参考文献：

Test-ADCredential在Windows 10上失败但在7上运行

1 个答案: