使用PowerShell进行Active Directory查询

Question

I am building a report on our active directory groups and am having a hard time when it comes to different forests.

We have groups from forestA with users inside from forestB. I was able to pull those groups using Quest AD:

 $GroupUsers = Get-QADGroupMember $GroupName -Type 'user' -Indirect 

The only problem is that even though the users inside are from forest B, they come up showing they are from forestA. They do exist in both forests, don't know if that's a problem.

Any clue on why this happens?

Thanks in advance.

Answer 1

There is -Server parameter of Get-ADGroupMember cmdlet where you may specify domain controller from another domain/forest. Something like:

Get-ADGroupMember -Identity $GroupName -Server DC.AnotherDomain.com

Answer 2

您可以查询林中的域或所有全局目录：get-adforest（属性GlobalCatalogs，Domains）-我经常这样做：我拉出组中所有SID的列表，然后检查哪个属于我的域/林，其余人员在外部森林中进行了搜索。