PowerShell命令AD用戶組成員比較基準

Question

我試圖找出邏輯做這樣的事情：

• 查詢所有廣告組在特定的OU
• 查詢所有用戶在一個特定的OU
• 查詢該用戶的所有組成員
• 如果任何用戶屬於在初始組查詢的一個或多個基團，輸出該信息
• 如果任何用戶屬於沒有一個組中最初的組查詢，也輸出該信息

我在這個網站挖了一遍，發現一個腳本，大部分的作品，但我堅持我如何可以比較用戶的組成員身份原我正在拉的組查詢。看起來我可以使用compare-object cmdlet，但參數似乎沒有包含任何讓我能夠跟蹤兩個對象共有多少個組的內容。

我在網上找到的代碼如下：

$groups = Get-ADGroup -Filter * | where {$_.distinguishedname -like "*,OU=TUNE_TEST_GROUPS,OU=TUNE_TEST,DC=tune,DC=priv"} 
$users = Get-ADUser -Filter * | where {$_.distinguishedname -like "*,OU=TUNE_TEST_USERS,OU=TUNE_TEST,DC=tune,DC=priv"} 

foreach ($User in $Users) { 
    $userGroups = Get-ADPrincipalGroupMembership $User 
    if ($userGroups.Count -gt 1) { 
     "{0} is a member of the following {1} groups:" -f $User.SamAccountName, $userGroups.Count 
     foreach ($group in $userGroups) { 
      "`t{0}" -f $group.Name 
     } 
    } elseif ($userGroups.Count -lt 1) { 
     "{0} is a member of the following {1} groups:" -f $User.SamAccountName, $userGroups.Count 
     foreach ($group in $userGroups) { 
      "`t{0}" -f $group.Name 
     } 
     } 
} 

這樣做的問題是，我沒有在1號線我比較用戶組名的組查詢的名稱的方法也無法確定用戶屬於該列表中的一個或多個組。我不確定我是否可以使用相同的計數方法。

Answer 1

您可以驗證帳戶從您的參考列表的至少一個組的成員通過使用Compare-Object：

foreach ($User in $Users) { 
    $userGroups = Get-ADPrincipalGroupMembership $User 
    if (!(Compare-Object $userGroups $groups -IncludeEqual -ExcludeDifferent)) { 
     "{0} doesn't belong to any reference group." -f $User.SamAccountName 
    } 
} 

---

邊注：使用的，而不是過濾的Get-ADUser和Get-ADGroup的結果-SearchBase參數通過在專有名稱上的通配符匹配：

$groups = Get-ADGroup -Filter * -SearchBase 'OU=TUNE_TEST_GROUPS,OU=TUNE_TEST,DC=tune,DC=priv' -SearchScope Subtree 
$users = Get-ADUser -Filter * -SearchBase 'OU=TUNE_TEST_USERS,OU=TUNE_TEST,DC=tune,DC=priv' -SearchScope Subtree 

Answer 2

我最終做了下面的事情這對我所需要的東西很有效。如果有人有興趣，示例代碼如下：

#gets a list of all groups in a given OU and stores the objects in the $groups variable 
$groups = Get-ADGroup -Filter * -SearchBase 'OU=TUNE_TEST_GROUPS,OU=TUNE_TEST,DC=tune,DC=priv' -Properties name | select name 

#pipe each group object into a foreach loop and output a string value of the same group name and stores it into the $groups_string variable 
$groups_string = $groups | % {$_.name} 

#gets a list of all users in a given OU and stores the objects in the $users variable 
$users = Get-ADUser -Filter * -SearchBase 'OU=TUNE_TEST_USERS,OU=TUNE_TEST,DC=tune,DC=priv' 


$results=@{ 
"Username" = "" 
"Groupname" = "" 
} 

$table=@() 

#iterates through every user in the $users variable and retrieves their group memberships 
foreach ($user in $users) { 
    #selects each group name and stores it in the $groupMembership variable 
    $groupMembership = Get-ADPrincipalGroupMembership $user | select name 

    #compares the names of each user's group to the baseline group name. 
    $groupMembership | foreach ($_) { 

     #If there is a match add the group name and the username to the $results hash table 
     if ($groups_string -contains $_.name) { 
      $results."Groupname" = $_.name 
      $results."Username" = $user.Name 

      #create a new PS object and supply the properties of the $results hash table to each object 
      $objresults = New-Object psobject -Property $results 

      #add each object to the $table array 
      $table += $objresults 
     } 
    } 

} 

#display/output the $table array and format it to fit 
$table | ft -AutoSize