Get-ADGroupmember 与两个组

Question

我有两个 AD 组，想提取他们的成员。如果我指定一个组，我可以运行脚本。当我放入第二组时，我不可能生成两个不同的报告。你能帮帮我吗？

$ADGroup= "Group_Test","Group_Test_ABC"
$Group = Get-ADGroupMember -Identity $ADGroup | ? {$_.objectclass -eq "user"}
$Path = "C:\Temp\$ADGroup $((Get-Date).ToString("(yyyy-MM-dd)")).xlsx"

$Result =
foreach ($User in $Group) {
    Get-ADUser -Identity $User -Properties * | Select @{n='ADGROUP NAME';e={$ADGroup}}, @{n="DisplayName";e={$_.DisplayName}}, @{n='SamAccountName';e={$_.SamAccountName}}, @{n='UPN';e={$_.UserPrincipalName}}
}

$Result | Export-Excel -Path $Path

Answer 1

Get-ADGroupMember 仅将一组作为输入，如果您需要查询多个组，则需要遍历组：

$ADGroup = "Group_Test", "Group_Test_ABC"
$result = foreach($group in $ADGroup)
{
    $members = Get-ADGroupMember -Identity $group | Where-Object {
        $_.objectclass -eq "user"
    }

    foreach($member in $members)
    {
        $user = Get-ADUser $member -Properties DisplayName

        [pscustomobject]@{
            'ADGROUP NAME'    = $group
            DisplayName       = $user.DisplayName
            SamAccountName    = $user.SamAccountName
            UserPrincipalName = $user.UserPrincipalName
        }
    }
}

$Path = "C:\Temp\$ADGroup $((Get-Date).ToString("(yyyy-MM-dd)")).xlsx"
$Result | Export-Excel -Path $Path

---

上述方法有另一种替代方法，效率更高，但它只会找到当前域中存在的那些用户，如果不同域中存在成员（用户），则不会找到它们。

$result = foreach($group in $ADGroup)
{
    $thisGroup = Get-ADGroup $group
    $splat = @{
        LDAPFilter = "(memberOf=$($thisGroup.DistinguishedName))"
        Properties = 'DisplayName'
    }
    $users = Get-ADUser @splat
    foreach($user in $users)
    {
        [pscustomobject]@{
            'ADGROUP NAME'    = $thisGroup.SamAccountName
            DisplayName       = $user.DisplayName
            SamAccountName    = $user.SamAccountName
            UserPrincipalName = $user.UserPrincipalName
        }
    }
}