如何解决循环中的错误以从 OU 获取 GPO

Question

我创建了一个 PS 脚本来查找在 OU 和 subOU 中链接的 GPO，我做错了什么？我收到此错误并对消息感到困惑：

Get-ADOrganizationalUnit：无法绑定参数“身份”。不能 转换“@{DistinguishedName=OU=Windows 7,DC=domain,DC=com}”值 类型 “Selected.Microsoft.ActiveDirectory.Management.ADOrganizationalUnit” 键入“Microsoft.ActiveDirectory.Management.ADOrganization alUnit”。 在 F:\Untitled4.ps1:11 char:39 + $LinkedGPOs = 获取 ADOrganizationalUnit

get-module activedirectory,grouppolicy

$exportFilePath = "c:\temp\AllGPOsWin7-report date $(get-date -f dd-MM-yyyy).csv"
$OU = "ou=Windows 7,dc=domain,dc=com"

$AllSubOU = Get-ADOrganizationalUnit -SearchBase $OU -SearchScope Subtree -Filter * | 
     Select-Object DistinguishedName

foreach ($OU in $AllSubOU){
$OU
$LinkedGPOs = Get-ADOrganizationalUnit $OU | select-object -ExpandProperty LinkedGroupPolicyObjects

$LinkedGPOGUID = $LinkedGPOs | foreach-object{$_.substring(4,36)}

$GPOName = $LinkedGPOGUID | foreach-object{get-gpo -guid $_ | select-object displayname}

$OU,$ListGPO -join "," | Out-File -FilePath $exportFilePath -Append -Width 200

Answer 1

问题在于你的

$AllSubOU = Get-ADOrganizationalUnit -SearchBase $OU -SearchScope Subtree -Filter * | 
 Select-Object DistinguishedName

命令，应该改为

$AllSubOU = Get-ADOrganizationalUnit -SearchBase $OU -SearchScope Subtree -Filter * | 
 Select-Object -ExpandProperty DistinguishedName

由于您没有指定展开部分，PowerShell 将其返回到容器中。因此，OU 在错误代码中的大括号 {} 中

更新 - 根据 cmets 关于此答案的信息，请参见下文：

#create a new hashtable
$hashTable = [hashtable]::new{}

#define the root OU
$rootOU = "OU=computers,DC=domain,DC=local"

#get all the sub OU in the root OU
$allSubOU = Get-ADOrganizationalUnit -SearchBase $rootOU -SearchScope Subtree -Filter * | Select-Object -ExpandProperty DistinguishedName

#loop through the sub OUs
foreach ($subOU in $allSubOU){

    #get the linked GPO objects on the OU
    $linkedGPO = Get-ADOrganizationalUnit $subOU | Select-Object -ExpandProperty LinkedGroupPolicyObjects

    #if the OU has a GPO then run through them
    if ($linkedGPO){

        #adding name to hashtable for current OU
        $hashTable.Add($subOU, @())

        #running through each GPO in sub OU
        foreach($GPO in $linkedGPO){

            #getting GUID from GPO
            $GPOGuid = $GPO.SubString(4,36)

            #using GUID to get displayname of GPO
            $GPOName = Get-GPO -Guid $GPOGuid | Select-Object -ExpandProperty DisplayName

            #add the GPO to the hashttable for the current OU
            $hashTable.$subOU += $GPOName
        }
    }else{
        #ou has no GPOs
        $hashTable.Add($subOU, "No GPO")
    }
}

#enumerate through the hashtable
$hashTable.GetEnumerator() | 
    #add OU to OU column in csv
    Select-Object -Property @{N='OU';E={$_.Name}},
    #add GPO to GPO(s) column in CSV
    @{N='GPO(s)';E={$_.Value}   } | 
    #export to CSV
    Export-Csv -NoTypeInformation -Path PATH

Answer 2

请注意，$ListGPO 不存在，如果链接了多个 GPO，您必须展开 GPO。 此外，Get-ADOrganizationalUnit 必须提取属性LinkedGroupPolicyObjects 才能使用它（使用-Properties LinkedGroupPolicyObjects） 我将 -join 中的分隔符从“，”更改为“|”因为专有名称里面有逗号。 此外，-width 200 将在达到该限制时切断 GPO。最好构建一个自定义对象并可能使用Export-Csv。

在下面找到一个暂定脚本。

get-module activedirectory,grouppolicy
$exportFilePath = "c:\temp\AllGPOsWin7-report date $(get-date -f dd-MM-yyyy).csv"
$myOU = "ou=Windows 7,dc=domain,dc=com"

$AllSubOU = (Get-ADOrganizationalUnit -SearchBase $OU -SearchScope Subtree -Filter *).DistinguishedName

foreach ($myOU in $AllSubOU){
    $myOU
    $LinkedGPOs = ( Get-ADOrganizationalUnit $myOU -properties LinkedGroupPolicyObjects).LinkedGroupPolicyObjects
    $LinkedGPOGUID = $LinkedGPOs | foreach-object{$_.substring(4,36)}
    $GPOName = ( $LinkedGPOGUID | foreach-object { (get-gpo -guid $_) | select-object -expandproperty displayname}) -join "|"
    $out = if ( $GPOname ) { $myOU,$GPOName -join "|"} else { $myOU } 
    $out | Out-File -FilePath $exportFilePath -Append -Width 200
}