从另一个域检索数据时 Get-ADGroup 挂起

Question

我有一个 PowerShell 脚本来检索所有 AD 组并将其放入表中。 此脚本需要在与我要从中检索组的域不同的域下的服务器上运行。 为了解决这个问题，我添加了代码来识别最近的 DC 并将其传递给Get-ADGroups的Server参数：

Import-Module ActiveDirectory

$DC = Get-ADDomainController -DomainName domain_name -Discover -NextClosestSite

$Groups = (Get-AdGroup -Server $DC.HostName[0] -Properties name, samaccountname, distinguishedname, sAMAccounttype, description, GroupType, GroupCategory, Info, Instancetype,  
                                   dSCorePropagationData,UsnCreated, UsnChanged, WhenCreated, whenchanged, ManagedBy -filter * )        

$Table = @()

$Record = @{
  "GroupName" = ""
  "sAmaccountName" = ""
  "DistinguishedName" = ""
  "sAMAccountType" = ""
  "Description" = ""
  "GroupType" = ""
  "GroupCategory" = ""
  "Info" = ""
  "InstanceType" = ""
  "dSCorePropagationData" = ""
  "UsnCreated" = ""
  "UsnChanged" = ""
  "WhenCreated" = ""
  "WhenChanged" = ""
  "ManagedBy" = ""
}
 
Foreach ($Group in $Groups) {             
           
    $Record."GroupName" = $Group.name            
    $Record."sAmaccountName" = $group.samaccountname
    $Record."DistinguishedName" = $group.distinguishedName
    $Record."sAMAccountType" = $group.sAMAccountType
    $Record."Description" = $group.description
    $Record."GroupType" = $group.grouptype
    $Record."GroupCategory" = $group.GroupCategory
    $Record."Info" = $group.info
    $Record."InstanceType" = $group.instancetype
    $Record."dSCorePropagationData" = $group.dSCorePropagationData
    $Record."UsnCreated" = $group.UsnCreated
    $Record."UsnChanged" = $group.UsnChanged
    $Record."WhenCreated" = $($group.Whencreated)
    $Record."WhenChanged" = $group.WhenChanged
    $Record."ManagedBy" = $group.ManagedBy
     
     
    $objRecord = New-Object PSObject -property $Record
    $Table += $objrecord 
 
  }            
            
 $Table | Select-Object GroupName, samaccountname, WhenCreated, whenchanged, GroupType, GroupCategory, sAMAccounttype, distinguishedname, description, Info, Instancetype,  
                              dSCorePropagationData, UsnCreated, UsnChanged, ManagedBy

代码在Foreach ($Group in $Groups)...之前一直有效Foreach ($Group in $Groups)...在那里它必须开始做真正的工作。 一旦到达那里，它就会挂起并且不会完成（通常在正确域上的服务器上运行时会在 15 分钟内完成）。 相同的域控制器和-server代码可以完美地用于Get-ADUser 。 是否存在导致挂断的原因，或者仅仅是网络性能问题？

Answer 1

在较大的数据集上肯定会减慢速度的一件事是创建一个固定大小的数组$table = @()然后在每次执行时创建一个新数组+=获取前一个数组的内容并添加到当前项目。 然后最后整个结果是通过Select-Object调用重新创建的，完全没有必要。 整个脚本可以简化为这个。

Import-Module ActiveDirectory

$DC = Get-ADDomainController -DomainName silverstar.local -Discover -NextClosestSite

$props = @{
    Server     = $DC.HostName[0]

    Properties = @(
        'name',
        'samaccountname',
        'distinguishedname',
        'sAMAccounttype',
        'description',
        'GroupType',
        'GroupCategory',
        'Info',
        'Instancetype',
        'dSCorePropagationData',
        'UsnCreated',
        'UsnChanged',
        'WhenCreated',
        'whenchanged',
        'ManagedBy'
    )

    Filter      = '*'
}

$Table = Foreach ($Group in Get-AdGroup @props){
    [PSCustomObject]@{
        GroupName             = $Group.name
        SamAccountName        = $Group.samaccountname
        WhenCreated           = $group.Whencreated
        WhenChanged           = $Group.WhenChanged
        GroupType             = $Group.grouptype
        GroupCategory         = $Group.GroupCategory
        sAMAccounttype        = $Group.sAMAccountType
        DistinguishedName     = $Group.distinguishedName
        Description           = $Group.description
        Info                  = $Group.info
        Instancetype          = $Group.instancetype
        dSCorePropagationData = $Group.dSCorePropagationData
        UsnCreated            = $Group.UsnCreated
        UsnChanged            = $Group.UsnChanged
        ManagedBy             = $Group.ManagedBy
    }
}

$Table

如果您想查看组的进展情况，可以将其从 foreach 语句更改为 Foreach-Object 循环。 前者通常更快，因为它都在内存中。

Import-Module ActiveDirectory

$DC = Get-ADDomainController -DomainName silverstar.local -Discover -NextClosestSite

$props = @{
    Server     = $DC.HostName[0]

    Properties = @(
        'name',
        'samaccountname',
        'distinguishedname',
        'sAMAccounttype',
        'description',
        'GroupType',
        'GroupCategory',
        'Info',
        'Instancetype',
        'dSCorePropagationData',
        'UsnCreated',
        'UsnChanged',
        'WhenCreated',
        'whenchanged',
        'ManagedBy'
    )

    Filter      = '*'
}

Get-AdGroup @props | ForEach-Object {
    [PSCustomObject]@{
        GroupName             = $_.name
        SamAccountName        = $_.samaccountname
        WhenCreated           = $_.Whencreated
        WhenChanged           = $_.WhenChanged
        GroupType             = $_.grouptype
        GroupCategory         = $_.GroupCategory
        sAMAccounttype        = $_.sAMAccountType
        DistinguishedName     = $_.distinguishedName
        Description           = $_.description
        Info                  = $_.info
        Instancetype          = $_.instancetype
        dSCorePropagationData = $_.dSCorePropagationData
        UsnCreated            = $_.UsnCreated
        UsnChanged            = $_.UsnChanged
        ManagedBy             = $_.ManagedBy
    }
} -OutVariable Table

这将允许您查看它，同时还收集$Table的输出。 它会减慢速度，因此我绝对建议将其全部捕获到任一格式的变量中。 对于第二个示例，只需删除-OutVariable Table并将$Table =放在Get-AdGroup ...前面Get-AdGroup ...