修复 try/catch 和输出

Question

我正在将用户的 OU 添加到组中，并且想要捕获：

1. 已添加用户
2. 已在列表中的用户
3. 将以上内容输出到文件中

下面的当前代码工作和输出：

用户名组名时间戳 -------- --------- --------- %用户名%%组名% 14/10/2019 15:50:49

但是，catch 不会捕获组中已经存在的用户并报告控制台上的输出。导出到 CSV 仅包含 OU 中的所有用户并显示它添加的时间。

我希望catch 输出在屏幕上触发，并在导出的 CSV 文件中显示用户是否已添加或在此运行中添加。

我正在使用的代码：

$groupName = 'SOMEGROUP'
$ou = 'OU=Users,DC=DC,DC=LOCAL'
$cred = Get-Credential -Credential bsg\myusername$

$results = Get-ADUser -Filter * -SearchBase $ou -Credential $cred | ForEach-Object {
    #Add the user to the group here
    $userName = $_.Name
    try {
        Add-ADGroupMember -Identity $groupName -Members $_.DistinguishedName -Credential $cred -ErrorAction Stop
    } catch {
        Write-Warning "User $userName is already a member of group $groupName"
    }

    # output a PsCustomObject that gets collected in the $results variable
    [PsCustomObject]@{
        'UserName'  = $userName
        'GroupName' = $groupName
        'TimeStamp' = Get-Date
    }
}

# output on console
$results | Format-Table -AutoSize

# Export to CSV file
$results | Export-Csv C:\PS\AddADGroupToUsers.csv -NoTypeInformation

Read-Host -Prompt "Press Enter to exit"

我不确定Add-ADGroupMember。重要的是那里的 DistingushedName 而不是 $userName？

我希望输出显示无效的catch。

我在两个语句中都使用了-Credential $cred，有没有更简单的方法可以让所有内容都以-Credential 作为会话而不是命令来运行？

---

回复已阅读并理解。 我运行了脚本。用户已经在组中，所以我希望他们都回来，因为“用户已经是组的成员......”。但它似乎出错了。

最新更新后的错误消息（该组已经有很多成员）：

Add-ADGroupMember : Cannot validate argument on parameter 'Members'. The argument is null, empty, or an element of the
argument collection contains a null value. Supply a collection that does not contain any null values and then try the
command again.
At C:\PS\add to usersNEW2.ps1:28 char:57
+ ... oupMember -Identity $groupName -Members $_.DistinghuishedName -ErrorA ...
+                                             ~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidData: (:) [Add-ADGroupMember], ParameterBindingValidationException
    + FullyQualifiedErrorId : ParameterArgumentValidationError,Microsoft.ActiveDirectory.Management.Commands.AddADGrou
   pMember

输出 CSV 不正确，因为没有添加用户，他们已经在其中。所以结果是错误的：

UserName    GroupName   TimeStamp           Status
TheUser     GROUPSActual    16/10/2019 15:23    User added successfully

所以远离 Theo 的代码，我尝试了 Ivan 的建议，但这需要很长时间：

# I'll use the DistinghuishedName because this is always unique in the forest
$currentMembers = Get-ADGroupMember -Identity $groupName | Select-Object -ExpandProperty DistinghuishedName

$results = Get-ADUser -Filter * -SearchBase $ou -credential $cred | ForEach-Object {

    # test if the user is already a member by checking the array

If ((Get-ADGroupMember -Identity $groupname).distinguishedName -contains $_.distinguishedName) {
    Write-Warning "User $userName is already a member of group $groupName"
}
else { 
    Add-ADGroupMember -Identity $groupName -Members $_.DistinguishedName -Credential $cred -ErrorAction Stop
}
        # output a PsCustomObject that gets collected in the $results variable
        [PsCustomObject]@{
            'UserName'  = $_.Name
            'GroupName' = $groupName
            'TimeStamp' = Get-Date
            'Status'    = $status
    }
}

我认为它正在工作，但需要几分钟才能从 7 个结果中获得 3 个结果，而原始代码在几秒钟内就可以工作。 编辑：代码已完成，并已写入托管警告。我知道我可以调整状态部分以将错误添加到状态中。只是不应该花这么长时间！

时间戳相隔几秒钟，但现在：

TimeStamp
16/10/2019 16:12
16/10/2019 16:14
16/10/2019 16:15
16/10/2019 16:16
16/10/2019 16:17
16/10/2019 16:18
16/10/2019 16:19

Answer 1

catch 块仅在 ErrorAction 设置为 Stop 时发生错误时执行。当用户已经是组的成员时，Add-ADGroupMember 不会返回错误。

我建议在 try 块中的脚本中使用某种逻辑。类似的东西：

If ((Get-ADGroupMember -Identity $groupname).distinguishedName -contains $_.distinguishedName) {
    Write-Warning "User $userName is already a member of group $groupName"
}
else { 
    Add-ADGroupMember -Identity $groupName -Members $_.DistinguishedName -Credential $cred -ErrorAction Stop
}

您仍然可以使用catch 块来处理可能发生的任何错误。

Answer 2

虽然我以前从未见过Add-ADGroupMember NOT 抛出异常Add-AdGroupMember : The specified account name is already a member of the group，但Ivan MIrchev 报告说，在他的环境中尝试添加已经是小组成员。

如果在某些环境中确实如此，那么相信该异常不再是一个好主意，我们需要采取额外的步骤，首先获取该组所有当前成员的列表。
这个额外的步骤当然会导致更长的处理时间..

# Get all user objects s that are currently member of the group and capture only 
# the usable property like SamAccountName or DistinghuishedName to use for the -Members 
# parameter of Add-ADGroupMember.
# the -Members parameter takes either:
#   the DistinghuishedName
#   the ObjectGUID
#   the SID
#   the SamAccountName

# Use a Hasttable object for fast lookup
$currentMembers = @{}
Get-ADGroupMember -Identity $groupName | Where-Object { $_.objectClass -eq 'user' } | ForEach-Object {
    # you could also use the SamAccountName, but they are only unique within the same domain.
    # I'll use the DistinghuishedName because this is always unique in the forest
    # the Value of the entry is not important, we'll only use the Key.
    $currentMembers[$_.DistinghuishedName] = $true
}

$results = Get-ADUser -Filter * -SearchBase $ou | ForEach-Object {
    # test if the user is already a member by checking if the lookup Hashtable has that Key
    $userName = $_.Name
    if ($currentMembers.ContainsKey($_.DistinghuishedName)) {
        Write-Host "User $userName is already a member of group $groupName"
        $status = "User $userName is already a member"
    }
    else {
        try {
            # the user is not already a member, so add him/her to the group
            Add-ADGroupMember -Identity $groupName -Members $_.DistinghuishedName -ErrorAction Stop
            $status = "User $userName added successfully"
        }
        catch {
            # something went wrong..
            $status = "User $userName could not be added to group $groupName. Error: $($_.Exception.Message)"
        }
    }

    # output a PsCustomObject that gets collected in the $results variable
    [PsCustomObject]@{
        'UserName'  = $userName
        'GroupName' = $groupName
        'TimeStamp' = Get-Date
        'Status'    = $status
    }
}
# output on console
$results | Format-Table -AutoSize

# Export to CSV file
$results | Export-Csv C:\PS\AddADGroupToUsers.csv -NoTypeInformation