Question

我制作了应该自动执行的退出脚本。该脚本工作正常，除了一部分。开头的凭证对象在其中一个功能中没有遵循。

它仍然需要凭证并连接到联机Exchange Powershell，但是由于某种原因，当脚本继续禁用MSOl帐户，删除许可证等时，它将停止并要求提供凭据；这是没有意义的，因为服务帐户已登录并连接并且会话已导入。

代码如下：

$username = "serviceaccountit@company.com"

$password = 'somepassword'

$secureStringPwd = $password | ConvertTo-SecureString -AsPlainText -Force 

$creds = New-Object System.Management.Automation.PSCredential -ArgumentList $username, $secureStringPwd

###############################################################

Set-ExecutionPolicy RemoteSigned -Force

$Session = New-PSSession -ConfigurationName Microsoft.Exchange - 
ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential 
$creds -Authentication  Basic -AllowRedirection

Import-PSSession $Session

Connect-MsolService -Credential $creds

Import-Module ActiveDirectory

########################################################################


$Exit = import-csv 'C:\File\Path\ETC'

$DisabledUserParams = @{

AccountName = $Exit.SamAccountName.Trim()

UPN = "$($Exit.SamAccountName.ToLower().Trim())@Company.com" 

}

########################################################################
#Add the scrubber function to be standard on the script
function Disable-ThisMSOLACCOUNT{

#variables

$AccountInfo = Get-MsolUser -UserPrincipalName $DisabledUserParams.UPN 

$CurrentAccountSku = $AccountInfo.Licenses.AccountSkuId

$MSOLAccountSku = Get-MsolAccountSku

$MSOLAccountLicense = $MSOLAccountSku.AccountSkuId

$DistributionGroups = Get-DistributionGroup

$DLs = $DistributionGroups.PrimarySmtpAddress

$CheckDL = Get-DistributionGroupMember -Identity $DLs

$SharedMailboxes = Get-Mailbox -ResultSize Unlimited -RecipientTypeDetails SharedMailbox

$MailDGS= Get-Recipient -ResultSize unlimited -RecipientType MailUniversalDistributionGroup

############################################################################################

foreach ($License in $MSOLAccountLicense) {

$RemoveLicense =@{

RemoveLicense = $License

}

try {

        Set-MsolUserLicense -UserPrincipalName $DisabledUserParams.UPN  RemoveLicenses $RemoveLicense.RemoveLicense -ErrorAction Continue }

       catch [Microsoft.Online.Administration.Automation.InvalidUserLicenseException,Microsoft.Online.Administration.Automation.SetUserLicense] {

        if ($_.Exception.Message -ilike "*Unable to assign this license because it is invalid") {

        Write-Host 'Error taking off License'

        Write-Host 'Run the Check at End'

        Continue

   }
   }
   } 

#####################################################################################################


foreach ($Distrolist in $DLs) {

   $RemoveDLM =@{

   RemoveGroup = $Distrolist

   Name = $CheckDL.Name

   }

        if($DisabledUserParams.AccountName -match $RemoveDLM.Name) {

            try {

            Remove-DistributionGroupMember -identity $RemoveDLM.RemoveGroup -member $DisabledUserParams.AccountName  -Confirm:$False -ErrorAction Continue }

            catch [Microsoft.Exchange.Management.RecipientTasks.RemoveDistributionGroupMember] 

            {

                if ($_.Exception.Message -ilike "*You don't have sufficient permissions") {

                Continue

                }
            }
        } 


   continue

   }


#####################################################################################################

foreach ($SM in $SharedMailboxes) {

   $RemoveSM =@{

   RemoveSM = $SM.Name

   }

    try {

           Remove-Mailboxpermission -identity $RemoveSM.RemoveSM -User $DisabledUserParams.AccountName  -Confirm:$False -ErrorAction Continue } 

    catch { 

                continue

   } 


#####################################################################################################

foreach($DGS in $mailDGS) {

    $RemoveMDGS = @{

    RemoveMDGS = $DGS.Name}

    try{
        Remove-RecipientPermission $RemoveMDGS.RemoveMDGS -Trustee $DisabledUserParams.AccountName -AccessRights SendAs -Confirm:$False} 

   catch { 

            continue

    } 

}
}
}

function Disable-ThisADACCOUNT{

$OUTransfer = "OU=Disabled Users Accounts,DC=company,DC=local"

$ADAccountPG = Get-ADPrincipalGroupMembership -Identity $DisabledUserParams.AccountName

$CurrentAdGroup = $ADAccountPG.name

Foreach($Group in $CurrentAdGroup) {

    $RemoveAdG = @{

    RemoveGroup = $group}

    Remove-ADGroupMember -Identity $RemoveAdG.RemoveGroup -Members $DisabledUserParams.AccountName -Confirm:$False -ErrorAction SilentlyContinue}


Get-ADUser $DisabledUserParams.AccountName | Move-ADObject -TargetPath $OUTransfer

}

try { Get-ADUser $DisabledUserParams.AccountName}  catch 
[Microsoft.ActiveDirectory.Management.ADIdentityNotFoundException,Microsoft.ActiveDirectory.Management.Commands.GetADUser] {

    if ($_.Exception.Message -ilike "*Cannot find an object with identity" )     { 

    Disable-ThisMSOLACCOUNT}

        else {Disable-ThisADACCOUNT

              Disable-ThisMSOLACCOUNT

              }

              }

代码被挂在Disable-ThisMSOOLACCOUNT功能上。它尝试使服务帐户重新登录，但是创建了PS cred对象，并且参数有效。

请让我知道可以解决此问题，因为拥有服务帐户可以使自动帐户创建/退出变得更好。

谢谢

Answer 1

https://social.technet.microsoft.com/Forums/en-US/2b34a686-fa2b-41a7-8155-059e2b35b393/using-pscredential-object-without-a-prompt-and-connecting-to-a-remote-registry-in-powershell?forum=ITCG

这是我发现如何使凭据正常工作的链接，而不再被提示。

回答者： EIG-Wes

问题出在远程签名上，可以通过运行以下命令解决：

Enable-PSRemoting -Force

向那个家伙致敬，但对我不利的家伙F * ck。说真的如果有问题，请发表评论。

我希望这可以帮助某人在PS中使用其IT服务帐户

Powershell凭证未通过的问题

1 个答案: