SetAccessRule - 部分或全部身份引用无法翻译

Question

我有一个在 Active Directory 中创建目录和组的脚本。只有组中的用户才能访问该目录。大多数时候它工作得很好，没有任何问题，但有时我得到一个异常，我不知道为什么。任何想法是什么问题？

我的代码：

[...]

New-ADGroup -Server $adserver -Path $adpath -Description $description -Name $groupname -GroupScope DomainLocal -GroupCategory Security
New-Item -Path $dirpath -Name "$dirname" -ItemType "directory"

Start-Sleep -s 30     #wait to make sure directory is created

$dp = "$dirpath\$dirname"

$Acl = Get-Acl $dp

#fileradmingroup
$Ar = New-Object System.Security.AccessControl.FileSystemAccessRule($admingroup,"FullControl","ContainerInherit,ObjectInherit","None","Allow")
$Acl.SetAccessRule($Ar) 
Set-Acl $dp $Acl

#remove inherited permissions
$Acl.SetAccessRuleProtection($true,$false) 
Set-Acl -Path $dp -AclObject

#new created group $groupname
$Ar = New-Object System.Security.AccessControl.FileSystemAccessRule($groupname,"DeleteSubdirectoriesAndFiles, Write, ReadAndExecute, Synchronize","ContainerInherit,ObjectInherit","None","Allow")
$Acl.SetAccessRule($Ar)     #this is the line where the exception occurs
Set-Acl $dp $Acl

[...]

这里是例外：

使用“1”参数调用“SetAccessRule”的异常：“部分或全部身份 无法翻译参考文献。” 在 L:\Skripte\Skript2.ps1:178 char:9 + $Acl.SetAccessRule($Ar) + ~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [], MethodInvocationException + FullyQualifiedErrorId : IdentityNotMappedException

Answer 1

我最近在一个有许多域控制器分布在多个站点的环境中创建新用户帐户和主目录时遇到了同样的挑战。我的解决方案是使用新创建帐户的 sid。

我更改了创建组的行和创建访问规则的行。 Start-Sleep 应该不需要并被注释掉。

我希望它适用于您的情况。

$NewGroup = New-ADGroup -Server $adserver -Path $adpath -Description $description -Name $groupname -GroupScope DomainLocal -GroupCategory Security -PassThru
New-Item -Path $dirpath -Name "$dirname" -ItemType "directory"

#Start-Sleep -s 30     #wait to make sure directory is created

$dp = "$dirpath\$dirname"

$Acl = Get-Acl $dp

#fileradmingroup
$Ar = New-Object System.Security.AccessControl.FileSystemAccessRule($admingroup,"FullControl","ContainerInherit,ObjectInherit","None","Allow")
$Acl.SetAccessRule($Ar) 
Set-Acl $dp $Acl

#remove inherited permissions
$Acl.SetAccessRuleProtection($true,$false) 
Set-Acl -Path $dp -AclObject

#new created group $groupname
$Ar = New-Object System.Security.AccessControl.FileSystemAccessRule($NewGroup.SID,"DeleteSubdirectoriesAndFiles, Write, ReadAndExecute, Synchronize","ContainerInherit,ObjectInherit","None","Allow")
$Acl.SetAccessRule($Ar)     #this is the line where the exception occurs
Set-Acl $dp $Acl