清单用户在广告组与递归不cmdlet的PowerShell脚本 [英] Listing users in ad group recursively with powershell script without CmdLets

问题描述

我想列出每个人都在Active Directory中的安全组，而不使用cmdlet在PowerShell中。奇怪的事情与我的脚本是，它的工作原理，如果我列出了整个目录，但如果我尝试和LDAP查询指定我想列出这是行不通的。我知道我的LDAP查询是正确的，因为我已经用它在另一个类似的VBS和它的作品。注释行是在那里我试图把在查询中。

  $ strFilter的=（及（objectCategory属性=人）（objectClass的=用户））
＃$ strFilter的=（及（objectCategory属性=人）（objectClass的=用户）（的memberOf = CN =公用名称，OU =用户组，...，DC =广告，DC =域，DC = COM））＃ ......只是冷落查询部分

＃$ objDomain会=新对象System.DirectoryServices.DirectoryEntry
$ objDomain会=新对象System.DirectoryServices.DirectoryEntry（LDAP：// CN =公用名称，OU =用户组，...，DC =广告，DC =域，DC = COM）＃...只是查询冷落的部分

$ objSearcher =新对象System.DirectoryServices.DirectorySearcher
$ objSearcher.SearchRoot = $ objDomain会
$ objSearcher.PageSize = 1000
$ objSearcher.Filter = $ strFilter的
$ objSearcher.SearchScope =子树

$ colProplist =名
的foreach（$ i的$ colPropList）{$ objSearcher.PropertiesToLoad.Add（$ I）}

$ colResults = $ objSearcher.FindAll（）

的foreach（$ objResult在$ colResults）
    {$ objItem = $ objResult.Properties; $ objItem.name}
 

解决方案

下面是一些在活动目录2003 SP2和2008 R2的工作。我使用ADSI和微软的<一href="http://msdn.microsoft.com/en-us/library/aa746475%28v=vs.85%29.aspx">LDAP_MATCHING_RULE_IN_CHAIN.它递归搜索（但在一个查询）从组中的所有用户（注意其返回用户的安全和分布组）

 清除-主机
$ DN =新对象System.DirectoryServices.DirectoryEntry（LDAP：// WM2008R2ENT：389 / DC = DOM，DC = FR，[e-mail]，PWD）

＃要查找组MonGrpPlusSec所有用户成员：
＃设置基地到组容器DN;比如根DN（DC =兴业，DC = FR）
＃设置范围，子树
＃使用以下过滤器：
＃（成员：1.2.840.113556.1.4.1941：= CN = MonGrpPlusSec，OU = ForUser1，DC = DOM，DC = FR）

$ dsLookFor =新的对象System.DirectoryServices.DirectorySearcher（$ DN）
$ dsLookFor.Filter = "(&(memberof:1.2.840.113556.1.4.1941:=CN=MonGrpPlusSec,OU=ForUser1,DC=dom,DC=fr)(objectCategory=user))";
$ dsLookFor.SearchScope =子树;
$ N = $ dsLookFor.PropertiesToLoad.Add（CN）;
$ N = $ dsLookFor.PropertiesToLoad.Add（distinguishedName来）;
$ N = $ dsLookFor.PropertiesToLoad.Add（sAMAccountName赋）;

$ lstUsr = $ dsLookFor.findall（）
的foreach（$ usrTmp在$ lstUsr）
{
  写主机$ usrTmp.Properties [SAM帐户名]
}
 

I'm trying to list everyone in a security group in an active directory without using CmdLets in PowerShell. The weird thing with my script is that it works if I list the entire directory but if I try and specify with an ldap query what I want to be listed it does not work. I know my ldap query is correct because I have used it in another similar vbs and it works. The commented lines are where i have tried to put in the query.

$strFilter = "(&(objectCategory=person)(objectClass=user))"
#$strFilter = "(&(objectCategory=person)(objectClass=user)(memberOf=CN=Common Name,OU=User Groups,...,DC=ad,DC=domain,DC=com))" #... is just left out part of query

#$objDomain = New-Object System.DirectoryServices.DirectoryEntry
$objDomain = New-Object System.DirectoryServices.DirectoryEntry("LDAP://CN=Common Name,OU=User Groups,...,DC=ad,DC=domain,DC=com") #... is just left out part of query

$objSearcher = New-Object System.DirectoryServices.DirectorySearcher
$objSearcher.SearchRoot = $objDomain
$objSearcher.PageSize = 1000
$objSearcher.Filter = $strFilter
$objSearcher.SearchScope = "Subtree"

$colProplist = "name"
foreach ($i in $colPropList){$objSearcher.PropertiesToLoad.Add($i)}

$colResults = $objSearcher.FindAll()

foreach ($objResult in $colResults)
    {$objItem = $objResult.Properties; $objItem.name}

解决方案

Here is something working in an Active-Directory 2003 SP2 and 2008 R2. I use ADSI and Microsoft LDAP_MATCHING_RULE_IN_CHAIN. It Search recursively (but in one query) all the users from a group (be careful it return users from security and distributions group)

Clear-Host
$dn = New-Object System.DirectoryServices.DirectoryEntry ("LDAP://WM2008R2ENT:389/dc=dom,dc=fr","[e-mail]","PWD")

# To find all the users member of groups "MonGrpPlusSec"  : 
# Set the base to the groups container DN; for example root DN (dc=societe,dc=fr)  
# Set the scope to subtree 
# Use the following filter : 
# (member:1.2.840.113556.1.4.1941:=CN=MonGrpPlusSec,OU=ForUser1,DC=dom,DC=fr) 

$dsLookFor = new-object System.DirectoryServices.DirectorySearcher($dn)
$dsLookFor.Filter = "(&(memberof:1.2.840.113556.1.4.1941:=CN=MonGrpPlusSec,OU=ForUser1,DC=dom,DC=fr)(objectCategory=user))"; 
$dsLookFor.SearchScope = "subtree"; 
$n = $dsLookFor.PropertiesToLoad.Add("cn"); 
$n = $dsLookFor.PropertiesToLoad.Add("distinguishedName");
$n = $dsLookFor.PropertiesToLoad.Add("sAMAccountName");

$lstUsr = $dsLookFor.findall()
foreach ($usrTmp in $lstUsr) 
{
  Write-Host $usrTmp.Properties["samaccountname"]
}

这篇关于清单用户在广告组与递归不cmdlet的PowerShell脚本的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！