Powershell连接和搜索多个域

Question

我正在尝试查找指定用户帐户的组成员身份。一个域的用户帐户通常是其他域中某个组的成员(有些域需要不同的管理员帐户)。使用get-QAQgroup，我可以成功地逐个搜索每个域，但是当我尝试遍历这些域时，我只能在我登录的域中找到结果。#更改域并查找指定用户帐户的组成员身份的脚本。

$domains = "dom1.ad.state.company.com","dom2.ad.state.company.com","dom3.ad.state.company.com","dom4.ad.state.company.com","corporate.state.company.com","OddNamedDom.com"
$CRED=GET-CREDENTIAL
$userAcc = read-host "Enter domain\username for Group Membership Search"

foreach ($domain in $domains)
  {
     write-host "In the domain $domain "," $userAcc is a direct member of..."
     Get-QADGroup -service $domain -Credential $cred -Containsmember $userAcc | select name
  } #foreach domain

Connect-QADService -Service 'dom1.ad.state.company.com'

当我运行脚本时，我得到了dom1 (我登录的域)的结果，其余的抛出了以下错误。我不确定为什么“参考文献1:..”行指向“dom1”。我想这可能是问题的根源。我已经复制了下面显示错误消息的Powershell输出。

In the domain dom1.ad.state.company.com   dom1\brownd2.admin.dom1 is a direct member of...

Name                                                                                                                                            
----                                                                                                                                        
DOM1-G-ITS-DS-Company Services                                                                                                                 
DOM1PGUELFP00003-Exmerge-R                                                                                                                   
DOMPGUELFP00003-Exmerge-C                                                                                                                   
ITSPPTBOSHFS003-FSSHARE-C                                                                                                                   
Domain Users                                                                                                                                

In the domain dom2.ad.state.company.com   dom1\brownd2.admin.dom1 is a direct member of...
Get-QADGroup : 0000202B: RefErr: DSID-03100742, data 0, 1 access points
    ref 1: 'dom1.ad.state.company.com'
At C:\TestScripts\tGet-UserAllMemberships.ps1:24 char:6
+      Get-QADGroup -service $domain -Credential $cred -Containsmember $userAcc |  ...
+      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Get-QADGroup], DirectoryAccessException
    + FullyQualifiedErrorId : Quest.ActiveRoles.ArsPowerShellSnapIn.DirectoryAccess.DirectoryAccessException,Quest.ActiveRoles.ArsPowerShel 
   lSnapIn.Powershell.Cmdlets.GetGroupCmdlet

In the domain dom3.ad.state.company.com   dom1\brownd2.admin.dom1 is a direct member of...
Get-QADGroup : 0000202B: RefErr: DSID-03100742, data 0, 1 access points
    ref 1: 'dom1.ad.state.company.com'
At C:\TestScripts\tGet-UserAllMemberships.ps1:24 char:6
+      Get-QADGroup -service $domain -Credential $cred -Containsmember $userAcc |  ...
+      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Get-QADGroup], DirectoryAccessException
    + FullyQualifiedErrorId : Quest.ActiveRoles.ArsPowerShellSnapIn.DirectoryAccess.DirectoryAccessException,Quest.ActiveRoles.ArsPowerShel 
   lSnapIn.Powershell.Cmdlets.GetGroupCmdlet

我正在检查的每个域都有一组类似的错误。我还没有发布完整的错误消息列表。

如果我更改数组中域的顺序，则成功的域的错误和结果只是更改顺序以匹配数组。我认为它可能只是成功的循环的第一次迭代。但事实并非如此。

我知道该帐户是Dom2中组的成员，而不是Dom3中任何组的成员。如果我将命令从foreach循环中取出，并在控制台中为每个域单独运行，我确实会得到预期的结果。基于单个结果，我曾认为这将是在循环中执行的简单示例，但我没有正确地连接到域。

我能改变什么？

Answer 1

这是一个使用System.DirectoryServices.AccountManagement命名空间的解决方案，它适应了C#代码中的PowerShell。这是一种递归的解决方案。在使用C#的Find Recursive Group Membership (Active Directory)中，我给出了一个递归解决方案(使用PowerShell 1.0中提供的基本ADSI )，该解决方案也适用于通讯组。

# Retreiving a principal context for the administrator on the Global Catalog
Add-Type -AssemblyName System.DirectoryServices.AccountManagement
$domainContext = New-Object DirectoryServices.AccountManagement.PrincipalContext([DirectoryServices.AccountManagement.ContextType]::Domain, "VMESS01:3268" , "administrator", "adminPasswd")
# Retreive the groups
try {
  $userPrincipal = [DirectoryServices.AccountManagement.UserPrincipal]::FindByIdentity($domainContext, "jpb")
  $groups = $userPrincipal.GetAuthorizationGroups()
  foreach($group in $groups)
  {
    $group.name;
  }
}
finally {
    $pc.domainContext()
}