将其他域中的用户添加到AD组

Question

I need to add all users from one AD group to another AD group. Both groups are in the same domain, though the users are from another domain in the forest.

Domain "LPC": $Source_Group and $Destination_Group
Domain "forestx": Users

Here one example I wrote with the help of this Microsoft article :

$Source_Group = "CN=TestSrc,OU=xxx,OU=yyy,DC=lpc,DC=de" 
$Destination_Group = "CN=TestDest,OU=xxx,OU=yyy,DC=lpc,DC=de" 

$SourceUseres = Get-ADGroupMember -Identity $Source_Group

foreach ($Person in $SourceUseres) { 
    $User = Get-ADUser $Person -Server forestx-dc-1
    Add-ADPrincipalGroupMembership -Server lpc-dc-1 $User -MemberOf $Destination_Group
}

Get-ADUser $Person -Server forestx-dc-1 seems to contain the right object if I write it to the comand line, but the reference seems not to work in the Add-ADPrincipalGroupMembership statement.

Answer 1

I found the answer myself using the Set-ADObject command:

$Source_Server = "x1"
$Source_Group = Get-ADGroup "xxx" -Server $Source_Server
$Destination_Server = "y1"
$Destination_Group = Get-ADGroup "yyy" -Server $Destination_Server

$SourceUseres = Get-ADGroupMember -Identity $Source_Group 

foreach ($Person in $SourceUseres) {
    Set-ADObject -Identity $Destination_Group -Add @{member=$Person.distinguishedName} -Server $Destination_Server
}