将新广告用户添加到组时发出警告

Question

作为创建用户脚本的一部分，我将根据用户的公司将用户添加到两个 AD 安全组。用户正在添加到组中，但我收到警告。我很困惑为什么当用户仍然被正确添加时我会收到警告。

警告：无法将成员添加到 ADGroup：“CN=HS,CN=Users,DC=MY,DC=DOMAIN”。错误是：'指定的帐户名已经是组的成员'。

警告：无法将成员添加到 ADGroup：“CN=HS Students,CN=Users,DC=My,DC=DOMAIN”。错误是：'指定的帐户名已经是组的成员'。

这是我的创建用户脚本

foreach ($User in $ADUsers)
{
#Read user data from each field in each row and assign the data to a  variable as below

$Username   = $User.ID
$Password   = $User.BDATE
$Firstname  = $User.FNAME
$Lastname   = $User.LNAME
$Department = $User.GRD
$Company    = $User.SCHID #This field refers to the OU the user account is to be moved to

# Choose OU
Switch ($Company)
{
    "1480" {$OU = 'OU=students,OU=users,ou=hs,dc=clasd,dc=net'}
    "1479" {$OU = 'OU=students,OU=users,ou=elem,dc=clasd,dc=net'}
}

#Check to see if the user already exists in AD
if (Get-ADUser -F {SamAccountName -eq $Username})
{
     #If user does exist, give a warning
     Write-Warning "A user account with username $Username already exist in Active Directory."
}
else
{
    #User does not exist then proceed to create the new user account
    "Processing started (on " + $date + "): " | Out-File $log -append
    "--------------------------------------------" | Out-File $log -append

    #Account will be created in the OU provided by the $OU variable read from the CSV file
    New-ADUser `
        -SamAccountName $Username `
        -UserPrincipalName "$Username@clasd.net" `
        -Name "$Firstname $Lastname" `
        -GivenName $Firstname `
        -Department "$Department" `
        -Company "$Company" `
        -EmailAddress "$Username@clasd.net" `
        -Surname $Lastname `
        -Enabled $True `
        -Scriptpath "login.vbs" `
        -DisplayName "$Firstname $Lastname" `
        -Path $OU `
        -AccountPassword (convertto-securestring $Password -AsPlainText -Force) `
        -ChangePasswordAtLogon $true

    #Start-Sleep 5

    # Add User to Groups
    Get-Aduser -filter 'company -eq "1480"' | %{Add-ADPrincipalGroupMembership -Identity $_.SamAccountName -MemberOf "HS", "HS Students"}

}
}

Answer 1

那么，您为什么要执行 get-aduser，您要获取所有将公司设置为 1480 的用户？您需要执行以下操作：

New-ADUser @args -PassThru | 
  ForEach-Object { Add-ADPrincipalGroupMembership -Identity $_.SamAccountName -MemberOf "HS", "HS Students" }

是的，考虑创建一个包含您需要的所有值的哈希表并将其发送到 new-aduser 命令，看起来更清晰，如下所示：

$args = @{
    DisplayName = $_.DisplayName 
    GivenName = $_.GivenName
    Surname = $_.sn
    SamAccountName = $_.SamAccountName
    UserPrincipalName = $($_.SamAccountName + "@xxx.xxx")
    Department = $_.Department
    Title = $_.Title
    City = $_.City
    Office = $_.Office
    MobilePhone = $_.MobilePhone
    OfficePhone = $_.telephoneNumber
    Name = $_.DisplayName
    Company = "xxx"
    Path = $path
    State = $region
}
New-ADUser @args -PassThru

Answer 2

正如你所说，用户没有“被正确添加”。

警告只是告诉您您的命令尚未完成其功能，因为它尝试执行的操作已经完成。

编辑：如果您不想显示黄色警告文本，可以将 WarningAction 参数设置为 SilentlyContinue 以抑制它：

Get-Aduser -filter 'company -eq "1480"' | %{Add-ADPrincipalGroupMembership -Identity $_.SamAccountName -MemberOf "HS", "HS Students" -WarningAction SilentlyContinue}
Get-Aduser -filter 'company -eq "1479"' | %{Add-ADPrincipalGroupMembership -Identity $_.SamAccountName -MemberOf "Elem", "Elem Students" -WarningAction SilentlyContinue}

这两个命令也需要移到脚本的末尾——所以它们在 foreach 循环之外。这意味着它们仅在创建所有新帐户后运行一次。