Powershell：将用户添加到数组中的组

Question

我正在尝试编写一个 PowerShell 脚本，该脚本将根据部门和职位创建一个用户，并将它们添加到特定于该职位的 AD 组中。我有一个函数可以创建新用户并尝试将用户加入到数组中的组列表中。

function CreateUser{
     $sam = "$first.$last";...;$pwd = ConvertTo-SecureString "password" -AsPlainText -Force
     New-ADUser -Company "MyCompany" -Department $dept -Description $desc -DisplayName $dname -EmailAddress $email -GivenName $first -Office $office -Path $path -SamAccountName $sam -Surname $last -UserPrincipalName $email
     foreach ($group in $groups) { if (Get-ADGroup $group) { Add-ADGroupMember $group $sam } }
     }

我还有一段代码可以创建 $groups 数组

$positions = @()
if ($dept -eq "CSR") { $positions += "CSR Rep","CSR Lead","CSR Manager" }
if ($dept -eq "IT") { $positions += "Sysadmin","Netadmin","Sqladmin" }
...
$groups = @()
if ($position -eq "CSR Rep") { $groups += "group1","group2","group3",...,"groupN" }
if ($position -eq "CSR Lead") { $groups += "group1","group2","group3","group4",...,"groupN" }
if ($position -eq "CSR Manager") { $groups += "group1","group2","group3","group4","group5",...,"groupN" }
if ($position -eq "Sysadmin") { $groups += "group6","group7",...,"groupN" }
if ($position -eq "Netadmin") { $groups += "group7","group8","group9",...,"groupN" }
if ($position -eq "Sqladmin") { $groups += "group10","group11","group12",...,"groupN" }

在我指定了创建组数组的部门和位置后，我调用了 CreateUsers 函数，但我得到了错误，就像它是一个空数组一样。

在尝试将参数传递给函数时我是否遗漏了什么，或者是否有更好的方法来完成此任务？
任何帮助将不胜感激。

Answer 1

由于您的代码没有显示函数调用并且您的函数没有定义任何参数，我假设您没有向它传递任何东西。

下面是如何使用带有三个示例参数的参数，其中一个是 String[]：

function CreateUser{
     param(
     [parameter(Mandatory=$True)]
     [ValidateNotNullOrEmpty()]
     [string[]] $groups,
     [parameter(Mandatory=$True)]
     [ValidateNotNullOrEmpty()]
     [hashtable] $userInfo,
     [parameter(Mandatory=$True)]
     [ValidateNotNullOrEmpty()]
     [securestring] $pwd
     )

     New-ADUser -Company "MyCompany" -Department $userInfo.dept -Description $userInfo.desc -DisplayName $userInfo.dname -EmailAddress $userInfo.email -GivenName $userInfo.first -Office $userInfo.office -Path $userInfo.path -SamAccountName $userInfo.sam -Surname $userInfo.last -UserPrincipalName $userInfo.email
     foreach ($group in $groups) { if (Get-ADGroup $group) { Add-ADGroupMember $group $userInfo.sam } }
     }

为了保持较低的参数数量，我将用户信息合并到一个哈希表中。哈希表是键值集，可以这样创建：

$userInfo = @{sam="sam"; dept="department"; desc="description"; ...}

要正确调用您的函数，请执行以下操作：

CreateUser -groups $groups -userInfo $userInfo -pwd $pwd

您当然可以添加更多参数。有关可能的定义和验证方法的文档，请参阅Technet

Answer 2

如果您要创建的函数不仅仅是带有参数的简单事物，我强烈建议您在其中包含参数。如：

function CreateUser{
Param([Parameter(Position=0)][string]$First = $(throw "You must specify a first name"),
[Parameter(Position=1)][string]$Last = $(throw "You must specify a last name"),
[Parameter(Position=2)][string]$Desc = $(throw "You must specify a description"),
[Parameter(Position=3)][string]$Dept = $(throw "You must specify a department"),
[Parameter(Position=4)][string]$Office = $(throw "You must specify an office"),
[Parameter(Position=5)][string]$Password = $(throw "You must specify a password"),
[string[]]$Groups
)
     $sam = "$first.$last"
     $pwd = ConvertTo-SecureString $Password -AsPlainText -Force
     $email = "$first.$last@company.com"
     $dname = "$First $Last"
     $Path = "ou=$office,ou=Users,DN=company,DN=local"
     New-ADUser -Company "MyCompany" -Department $dept -Description $desc -DisplayName $dname -EmailAddress $email -GivenName $first -Office $office -Path $path -SamAccountName $sam -Surname $last -UserPrincipalName $email
     foreach ($group in $groups) { if (Get-ADGroup $group) { Add-ADGroupMember $group $sam } }
}

然后，当您调用该函数时，您会这样做：

CreateUser "Jim" "Kirk" "Captain Extraordinaire" "Space" "$uper$ecret123" @("ExploreNewWorlds","WhereNoManHasGone")

或者您可以按名称指定参数：

CreateUser -First "Jim" -Last "Kirk" -Desc "Captain Extraordinaire" -Dept "Space" -Password "$uper$ecret123" -Groups @("ExploreNewWorlds","WhereNoManHasGone")

...当我忙于发布这篇文章时，Paul 打败了我。干得好，保罗！

编辑： 另外，我想向您介绍Switch cmdlet。我想你会从中受益匪浅。虽然您的几个 If 语句可能确实有效，但请考虑一下：

Switch($position){
    "CSR Rep" { $groups += "group1","group2","group3",...,"groupN";continue }
    "CSR Lead" { $groups += "group1","group2","group3","group4",...,"groupN";continue }
    "CSR Manager" { $groups += "group1","group2","group3","group4","group5",...,"groupN";continue }
    "Sysadmin" { $groups += "group6","group7",...,"groupN";continue }
    "Netadmin" { $groups += "group7","group8","group9",...,"groupN";continue }
    "Sqladmin" { $groups += "group10","group11","group12",...,"groupN" }
}

这很简单，在您的情况下可能不会提供太多的性能改进，但 Switch 提供了一个更简洁的解决方案，并且通过多个 If 语句提高了性能。它还允许更多的逻辑，例如：

Switch($position){
    {$_ -match "CSR" } { $groups += "group1", "group2" }
    {$_ -match "CSR" -and -not $_ -match "Rep"} { $groups += "group3","Group4" }
}

这将为所有 CSR 添加第 1 组和第 2 组，并且只有领导和经理获得第 3 组和第 4 组。无论如何，只是需要考虑的事情。