New-ADServiceAccount Powershell 脚本不工作答案

【问题标题】：New-ADServiceAccount Powershell script is not workingNew-ADServiceAccount Powershell 脚本不工作
【发布时间】：2022-01-11 10:05:58
【问题描述】：

您好 StackOverflow 家族，

希望你一切都好？在过去的 4 天里，我在 PowerShell 脚本中遇到了一个问题。我已经创建/修改了 50 多次相同的脚本并对其进行了测试。每次它都会捕获或得到一些错误。而且错误不清楚所以找不到原因。

你能帮我吗？谢谢

if ($action -like 'create_ad_svc_acc') {                      
<#
 | Set-ADAccountPassword -Identity $svcAccountName -Reset -NewPassword (ConvertTo-SecureString $Password -AsPlainText -Force)
#>

try{
    $svcAccountName = "testing_account" 
    $passwordExp = "no"
    $InteractiveLogon = "yes"               
    #password
    $password = "Welcome@1234567890"                              
    #organizational unit
    $path = "OU=Service,OU=Accounts,OU=testcompany OU=Administration,DC=domain,DC=internal" #changed the path for company privacy pupose
    #Dormant OU
    $dormantPath = "OU=Users,OU=Dormant,DC=domain,DC=internal"
    #dns host (mandatory)            
    $dnsHost="test.domain.internal" #changed the host for company privacy pupose
    #Set Password expiry
    if ($passwordExp -like 'no'){                  #environment dependent
        $expiryFlag = $True
    }
    else{
        $expiryFlag = $false
    }

    #create new account

        New-ADServiceAccount `
        -SamAccountName $svcAccountName `
        -name $svcAccountName `
        -Enabled $true `
        -Path $path `
        -DNSHostName $dnsHost `
        -AccountPassword (ConvertTo-SecureString $Password -AsPlainText -Force) `

    sleep 2

    if (Get-ADServiceAccount -Identity $svcAccountName){
         if ( $InteractiveLogon -like "no"){
                    Add-ADGroupMember -Identity GBL_DenyLogonLocally -Members $svcAccountName
         }
    }
    Write-Host "Service account has been created"
}
catch{
    Write-Warning "There was an error while creating the service account"
}

return

}

【问题讨论】：

您能否删除不必要的 PowerShell 标签，只留下您当前正在运行的标签？还有，什么错误？你可以发布它们吗？您可能希望显示错误以进行故障排除，因此至少在您的 catch 块中使用$_.Exception.Message（或$_），或者深入了解$Error 以获得更深入的了解。也许行号会给你一个线索。此外，在使用通配符表达式时，除非匹配的字符串与正在评估的字符串相同，否则您必须提供通配符 (*)："test" -Like 'st' "test" -Like '*st'

标签： powershell powershell-2.0 powershell-3.0 azure-powershell powershell-4.0

【解决方案1】：

按照 cmets 中的建议，您可以通过将默认的错误输出变量放在 catch 块中来显示错误

当您创建一个帐户并想快速检查它时，您必须查询与您创建它的那个相同域控制器，否则脚本可能会出错，因为它检查了另一个 DC 但它还没有复制到那个 DC

  if ($action -like 'create_ad_svc_acc') {                      
  <#
   | Set-ADAccountPassword -Identity $svcAccountName -Reset -NewPassword (ConvertTo-SecureString $Password -AsPlainText -Force)
  #>

  try{
      $svcAccountName = "testing_account" 
      $passwordExp = "no"
      $InteractiveLogon = "yes"               
  #password
      $password = "Welcome@1234567890"                              
  #organizational unit
      $path = "OU=Service,OU=Accounts,OU=testcompany OU=Administration,DC=domain,DC=internal" #changed the path for company privacy pupose
  #Dormant OU
      $dormantPath = "OU=Users,OU=Dormant,DC=domain,DC=internal"
  #dns host (mandatory)            
      $dnsHost="test.domain.internal" #changed the host for company privacy pupose

  #Set Password expiry
      if ($passwordExp -like 'no'){                  #environment dependent
          $expiryFlag = $True
      }
      else{
          $expiryFlag = $false
      }

  #create new account

      New-ADServiceAccount `
      -SamAccountName $svcAccountName `
      -name $svcAccountName `
      -Enabled $true `
      -Path $path `
      -DNSHostName $dnsHost `
      -AccountPassword (ConvertTo-SecureString $Password -AsPlainText -Force) `

      sleep 2
      ### Query the SAME DC we created the account on
      if (Get-ADServiceAccount -Identity $svcAccountName -Server $DNSHostname -ErrorAction Stop){
          Write-Host "Service account has been created"
          if ( $InteractiveLogon -like "no"){
              Add-ADGroupMember -Identity GBL_DenyLogonLocally -Members $svcAccountName
          }
      }
      ###
  }
  catch{
      Write-Warning "There was an error while creating the service account"
  ### This var contains the error
  $_
  ###
  }
  return
  }

【讨论】：