有两个组的Get-ADGroup员

Question

我有两个广告组，想要提取他们的成员。如果我指定一个组，我可以运行脚本。当我提出第二个小组时，我不可能产生两个不同的报告。你能帮帮我吗?

$ADGroup= "Group_Test","Group_Test_ABC"
$Group = Get-ADGroupMember -Identity $ADGroup | ? {$_.objectclass -eq "user"}
$Path = "C:\Temp\$ADGroup $((Get-Date).ToString("(yyyy-MM-dd)")).xlsx"

$Result =
foreach ($User in $Group) {
    Get-ADUser -Identity $User -Properties * | Select @{n='ADGROUP NAME';e={$ADGroup}}, @{n="DisplayName";e={$_.DisplayName}}, @{n='SamAccountName';e={$_.SamAccountName}}, @{n='UPN';e={$_.UserPrincipalName}}
}

$Result | Export-Excel -Path $Path

Answer 1

Get-ADGroupMember只接受一个组作为输入，如果需要查询多个组，则需要遍历组：

$ADGroup = "Group_Test", "Group_Test_ABC"
$result = foreach($group in $ADGroup)
{
    $members = Get-ADGroupMember -Identity $group | Where-Object {
        $_.objectclass -eq "user"
    }

    foreach($member in $members)
    {
        $user = Get-ADUser $member -Properties DisplayName

        [pscustomobject]@{
            'ADGROUP NAME'    = $group
            DisplayName       = $user.DisplayName
            SamAccountName    = $user.SamAccountName
            UserPrincipalName = $user.UserPrincipalName
        }
    }
}

$Path = "C:\Temp\$ADGroup $((Get-Date).ToString("(yyyy-MM-dd)")).xlsx"
$Result | Export-Excel -Path $Path

除了上述方法之外，还有一种不同的选择，即更有效的方法，但只有在当前域上存在的用户才能找到，如果在不同的域上有成员(用户)，则不会找到他们。

$result = foreach($group in $ADGroup)
{
    $thisGroup = Get-ADGroup $group
    $splat = @{
        LDAPFilter = "(memberOf=$($thisGroup.DistinguishedName))"
        Properties = 'DisplayName'
    }
    $users = Get-ADUser @splat
    foreach($user in $users)
    {
        [pscustomobject]@{
            'ADGROUP NAME'    = $thisGroup.SamAccountName
            DisplayName       = $user.DisplayName
            SamAccountName    = $user.SamAccountName
            UserPrincipalName = $user.UserPrincipalName
        }
    }
}