尝试使用调用命令获取与 OU 相关的所有 GPO

Question

I have a this set of code:

#Find the OU with the selected Canonical name and save it to this variable
$OUObject = Invoke-Command -Session $S -ScriptBlock {Get-ADOrganizationalUnit -filter *  -Property CanonicalName | Where-Object {$_.CanonicalName -eq $using:listBox2.SelectedItem}}

So after this code i get a an OU stored in a variable $OUObject. i now want to get all the gpo's linked to this ou. so my next step is this:

$test = $OUObject.LinkedGroupPolicyObjects

and now $test hold all the gpos linked to its ou. problem now is i want to get them by name. so i can do this:

invoke-command -session $s -scriptblock {get-gpo -guid $test} 

but i will get this error: PS C:\WINDOWS\system32> invoke-command -session $s -scriptblock {get-gpo -guid $test} Cannot validate argument on parameter 'Guid'. The argument is null or empty. Provide an argument that is not null or empty, and then try the command again. + CategoryInfo: InvalidData: (:) [Get-GPO], ParameterBindingValidationException + FullyQualifiedErrorId: ParameterArgumentValidationError,Microsoft.GroupPolicy.Commands.GetGpoCommand + PSComputerName: DC01

so i look at $test and this is what it holds:

PS C:\WINDOWS\system32> $test
cn={5873971D-F689-4E83-8AFA-389FDD7F34CD},cn=policies,cn=system,DC=bla,DC=local
cn={2B7F8931-038E-46BC-B1DB-FBFA86097C08},cn=policies,cn=system,DC=bla,DC=local
cn={C74CADA1-B609-44A3-8D3C-F733CF3112E2},cn=policies,cn=system,DC=bla,DC=local

so what i acually need is to past to the get-gpo command only the part inside the cn{..}

if i hardcode for example and do this:

invoke-command -session $s -scriptblock {get-gpo -guid 5873971D-F689-4E83-8AFA-389FDD7F34CD} 

i get the result right. can anyone help me achive this please?

Answer 1

Use the regex -replace operator to extract the GUID from the DN, then pass the value to Invoke-Command using the $using: modifier:

$GUIDs = $test -replace '^cn=(\{[0-9a-f-]+\}).*$'
Invoke-Command -Session $s { $using:GUIDs |ForEach-Object { Get-GPO -Guid $_ } }