用于从 AD 组中删除成员的 Powershell 脚本不适用于所有组/用户

Question

我有以下代码删除特定 OU 中的用户成员资格，该 OU 不适用于某些用户。 我测试了从 $UserDN 到删除的行，它在一个用户中按预期工作，修复了 DN。

你能帮我找出为什么会发生这种情况吗？

谢谢！

    {
        $CurrentAction = $Message
        $TraceLog += ((Get-Date).ToString() + "`t" + $Message + " `r`n") | add-content  ‘D:\Logs\AD Removal\logfile_’ + $datestring + ‘.log’
        
    }

$path = "OU=Tango,OU=People,DC=Lab,DC=Dev";

Get-ADUser -Filter * -SearchBase $path -Properties memberof| Select DistinguishedName, @{n='memberOf';e={$_.memberOf -join '; '}} | export-csv d:/Remove AD Membership/usersbeforescript.csv -NoTypeInformation

$ExceptGroup = "Domain Users";
$users = Get-ADUser -SearchBase $path -Filter *

foreach ($user in $users) {
        try {
            $UserDN = $user.DistinguishedName
            Get-ADGroup -LDAPFilter "(member=$UserDN)" | foreach-object {
                if ($_.name -ne $ExceptGroup) {
                    Remove-ADGroupMember -identity $_.name -Member $UserDN -confirm:$false
        }
            AppendLog “Removed group $_.name from $user”
                }
         catch {
                     AppendLog ”Failed to remove group $_.name from $user”
        }
    
    }
}

Answer 1

为了查看究​​竟是什么导致了异常，您需要在try{..}块内的 cmdlet 上使用-ErrorAction Stop ，因此当发生错误时，您可以在catch{..}块中获取其详细信息.

为此，我会像这样编写你的foreach ($user in $users) {..}循环：

$path = "OU=Tango,OU=People,DC=Lab,DC=Dev"
$users = Get-ADUser -SearchBase $path -Filter * -Properties MemberOf

# export to csv before removing users from groups
$users | Select DistinguishedName, @{n='MemberOf';e={$_.MemberOf -join '; '}} -ExcludeProperty MemberOf | 
         Export-Csv -Path 'd:\Remove AD Membership/usersbeforescript.csv' -NoTypeInformation

$ExceptGroup = "Domain Users"


foreach ($user in $users) {
    $filter = "(member=$($user.DistinguishedName))"
    Get-ADGroup -LDAPFilter $filter | Where-Object { $_.Name -ne $ExceptGroup } | ForEach-Object {
        # store the group name in a variable for when we hit the catch block
        $group = $_.Name
        try {
            # append -ErrorAction Stop to catch also non-terminating exceptions
            $_ | Remove-ADGroupMember -Members $user -Confirm:$false -ErrorAction Stop
            AppendLog "Removed user $($user.Name) from group $group"
        }
        catch {
            # inside the catch block, automatic variable $_ is the error object itself
            AppendLog "Failed to remove user $($user.Name) from group $group`r`n$($_.Exception.Message)"
        }
    }
}

笔记：

• 我们看不到您的自定义AppendLog函数的代码，所以我只能假设这做了它应该做的事情
• 无需执行两次Get-ADUser
• 应该引用 CSV 文件的输出路径，因为它包含空格
• 最好不要在代码中使用像”这样的卷曲印刷引号，因为有一天这可能会给您带来奇怪的错误。.