Question

我正在尝试根据OU将AD组添加到用户配置文件中

我有一个类似的脚本在工作，因此尝试对其进行修改但失败了。我猜可能是“ -Identity $ _”，但是我不够好调试。

#Create a new class to hold the info for our CSV entry
Class CSVEntry{
    [String]$UserName
    [String]$GroupName
    [String]$TimeStamp
}

#Creating a list to hold the CSV entries
$Results = New-Object 'System.Collections.Generic.List[PSObject]'

#Defined the name of the group here
$GroupName = 'GROUPS NAME'
$ou = 'ou=XX,ou=XX,ou=XX,dc=XX,dc=local'

Get-ADUser -Filter * -SearchBase $ou | ForEach-Object{

    #Add the user to the group here
    Add-ADPrincipalGroupMembership -MemberOf $GroupName Identity $_

    #Write-Host $_.Name - $groupName 

    #Build a custom CSVEntry object and add it to the list
    $newRecord = [CSVEntry]::new()
    $newRecord.UserName = $_.Name
    $newRecord.GroupName = $groupName
    $newRecord.TimeStamp = Get-Date

    #Add the new record to the list
    $Results.Add($newRecord)
}


#Export the list of CSV entries
$Results | Export-Csv C:\PS\AddADGroupToUsers.csv

错误：

Add-ADPrincipalGroupMembership : A positional parameter cannot be found that accepts argument 'CN=NAME,OU=XX,OU=XX,OU=XX,OU=XX,DC=XX,DC=LOCAL'.
At line:18 char:5
+     Add-ADPrincipalGroupMembership -MemberOf $GroupName Identity $_
+     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidArgument: (:) [Add-ADPrincipalGroupMembership], ParameterBindingException
    + FullyQualifiedErrorId : PositionalParameterNotFound,Microsoft.ActiveDirectory.Management.Commands.AddADPrincipal
   GroupMembership

编辑：因此，该脚本实际上不会进行任何更改，也不会将该组添加到用户。屏幕上的输出是：

WARNING: User  is already a member of group XYZ
WARNING: User  is already a member of group XYZ
WARNING: User  is already a member of group XYZ

UserName GroupName                          TimeStamp
-------- ---------                          ---------
shows ok       XYZ        14/10/2019 14:50:23
shows ok       XYZ        14/10/2019 14:50:23
shows ok       XYZ        14/10/2019 14:50:23

我所要做的只是将组名更改为XYZ，而用户名在下半年显示为ok。但是，在顶部显示为空白，我向您保证：a）用户尚未在组中； b）脚本未添加他们

当前已调整的代码，疣以及几乎所有已清除的疾病：

$groupName = 'GROUP'
$ou = 'setcorrectly'
$cred = Get-Credential -credential dom\usr

$results = Get-ADUser -Filter * -SearchBase $ou -Credential $cred | ForEach-Object {
    #Add the user to the group here
    try {
        Add-ADGroupMember -Identity $groupName -Members $_.DistinguishedName -Credential $cred -ErrorAction Stop
    }
    catch {
        Write-Warning "User $($_.Name) is already a member of group $groupName"
    } 

        # output a PsCustomObject that gets collected in the $results variable
        [PsCustomObject]@{
            'UserName'  = $_.Name
            'GroupName' = $groupName
            'TimeStamp' = Get-Date
}
}

# output on console
$results | Format-Table -AutoSize

# Export to CSV file
$results | Export-Csv C:\PS\AddADGroupToUsers.csv -NoTypeInformation

Read-Host -Prompt "Press Enter to exit"

CSV输出仅显示屏幕输出的后半部分，并且没有说什么已经是成员

Answer 1

以下使用Add-ADGroupMember来将用户添加到1个组，而不是使用Add-ADPrincipalGroupMembership来将1个用户添加到多个组。

它还使用[PsCustomObject] s输出结果，因此您无需使用CSVEntry类。

# Define the name of the group here.
# can be either:
# A distinguished name
# A GUID (objectGUID)
# A security identifier (objectSid)
# A Security Account Manager account name (sAMAccountName)
$groupName = '<NAME OF THE GROUP>'

$ou = 'ou=XX,ou=XX,ou=XX,dc=XX,dc=local'

$results = Get-ADUser -Filter * -SearchBase $ou | ForEach-Object {
    #Add the user to the group here
    $userName = $_.Name
    try {
        Add-ADGroupMember -Identity $groupName -Members $_.DistinghuishedName -ErrorAction Stop
        # output a PsCustomObject that gets collected in the $results variable
        [PsCustomObject]@{
            'UserName'  = $_.Name
            'GroupName' = $groupName
            'TimeStamp' = Get-Date
        }
    }
    catch {
        Write-Warning "User $userName is already a member of group $groupName"
    } 
}

# output on console
$results | Format-Table -AutoSize

# Export to CSV file
$results | Export-Csv C:\PS\AddADGroupToUsers.csv -NoTypeInformation

编辑

如果您希望$results变量也包含已经属于该组的用户，则可以简单地将[PsCustomObject]的创建移到catch{..}块下面：

$results = Get-ADUser -Filter * -SearchBase $ou | ForEach-Object {
    #Add the user to the group here
    $userName = $_.Name
    try {
        Add-ADGroupMember -Identity $groupName -Members $_.DistinghuishedName -ErrorAction Stop
        $status = "User added successfully"
    }
    catch {
        Write-Warning "User $userName is already a member of group $groupName"
        $status = "User is already a member"
    }

    # output a PsCustomObject that gets collected in the $results variable
    [PsCustomObject]@{
        'UserName'  = $userName
        'GroupName' = $groupName
        'TimeStamp' = Get-Date
        'Status'    = $status
    }
}

希望有帮助

使用正确的CSV输出将用户添加到AD组

1 个答案: