使用Powershell将计算机移至SCCM 2012任务序列中的新OU

Question

How to move a computer to a new OU as a step in SCCM Task Sequence?

Requirements:

• Powershell instead of VBS
• No "File" on the sccm client system

As this is a Task Sequence step, the command will be executed locally on the SCCM Client so using the Active-Directory module is not an option unless the module is installed on every system that could be affected by this task.

Command-line execution defaults to CMD.exe, forcing to deal with painful string escape steps.

Answer 1

Looking around online I found a blog post that details SCCM allows for a step in Task Sequences called "Run Command Line". However that blog post solution is not a stand-alone command line execution.

Additionally, I found a blog post with snippits for using ADSI instead of the Active-Directory module when attempting a Powershell solution to move the local host (any non-Domain Controller) to a new OU.

Combining those procedures into a single command line execution, it took some time, but i was able to work around combining the CMD.exe string parsing/escaping and the Powershell string parsing/escaping into a single command line execution that will work within a SCCM task sequence.

• In SCCM2012: When editing a Task Sequence click Add, General, "Run Command Line"

Command line:

C:\windows\system32\WindowsPowerShell\v1.0\powershell.exe -command iex \" `$TargetOU=\"\"OU=TargetOUName,DC=ConglomiCo,DC=com\"\"; `$SysInfo=New-Object -ComObject \"\"ADSystemInfo\"\";`$ComputerDN=`$SysInfo.GetType().InvokeMember(\"\"ComputerName\"\",\"\"GetProperty\"\",`$Null,`$SysInfo,`$Null);`$Computer=[ADSI]\"\"LDAP://`$ComputerDN\"\";`$OU=[ADSI]\"\"LDAP://`$TargetOU\"\";`$Computer.psbase.MoveTo(`$OU);" \"

Note: Be sure to specify a domain account in the "Run Command Line" task that has the proper permissions:

• Administrative execution permission on the SCCM Client system
• AD permissions to move computer account objects
• Write access to the destination OU

This solution contains the destination OU within the Command Line entry, however it is easily modifiable to read a registry entry, text file on the file system, etc which could contain the destination OU DN.