通过ADSI适配器将计算机添加到特定域控制器上的AD组

Question

我在具有向AD组添加成员权限的用户上下文中运行此脚本。我已经验证了权限，可以通过ADUC手动添加成员。

我想将我的计算机添加到特定域控制器上的特定组中。我对ADSI的用法非常陌生，我根据其他例子拼凑出了下面的脚本。在运行此脚本时，我无法使用PS AD模块。

Param(
[Parameter(Mandatory)]
[string]$GroupName
)
#Find domain controllers
$searcher = New-Object System.DirectoryServices.DirectorySearcher([adsi] "LDAP://OU=Domain Controllers,DC=corp,DC=thing,DC=com")
$searcher.Filter = "(objectclass=computer)"
$DomainControllers = $searcher.FindAll()
Write-Verbose "Found DCs:"
foreach ($dc in $DomainControllers.Properties.cn)
{
Write-Verbose "$dc"
}
$TargetController = $null
$ComputerDn = $null
foreach ($dc in $DomainControllers.Properties.cn)
{        
$searcher = New-Object System.DirectoryServices.DirectorySearcher([adsi] "LDAP://$dc/DC=corp,DC=thing,DC=com")
$searcher.Filter = "(&(objectclass=computer)(cn=$env:COMPUTERNAME))"
$result = $searcher.FindOne()
try {
if ($result)
{
$TargetController = $dc
Write-Verbose "Target controller set: $TargetController"
$ComputerDn = $result.Properties.distinguishedname
Write-Verbose "Computer DN: $ComputerDn"

break
}
else
{
Write-Verbose "Did not find $env:COMPUTERNAME on $dc"
}
}
catch
{
Write-Verbose "$dc ERROR"
}
}
if ($TargetController)
{
$GroupSearcher = New-Object System.DirectoryServices.DirectorySearcher([adsi] "LDAP://$TargetController/DC=corp,DC=thing,DC=com")
$GroupSearcher.Filter = "(&(objectclass=group)(cn=$GroupName))"
$GroupDn = $GroupSearcher.FindOne().Properties.distinguishedname
$Group = [ADSI] "LDAP://$TargetController/$GroupDn"
$ComputerSearcher = New-Object System.DirectoryServices.DirectorySearcher([adsi] "LDAP://$TargetController/DC=corp,DC=thing,DC=com")
$ComputerSearcher.Filter = "(&(objectclass=computer)(cn=$env:COMPUTERNAME))"
$result = $ComputerSearcher.FindOne().Properties.memberof -match "cn=$GroupName,"

if (!$result)
{
try
{            
$Computer = [adsi] "LDAP://$TargetController/$ComputerDn"
$Group.Add("$Computer")
}
catch 
{
$_.Exception.Message ; Exit 1
}
}
else
{
Write-Verbose "$env:COMPUTERNAME already a member of $GroupName"
}
}

运行此操作时，我得到错误"；异常调用"；添加"；用"；1〃；自变量："；HRESULT:0x80005000的异常；。我对任何其他选择都持开放态度！

Answer 1

正如Bill Stewart所评论的，您应该移除[adsi]加速器

$Computer = "LDAP://$TargetController/$ComputerDn"
$Group.Add($Computer)

或指定路径

$Computer = [adsi] "LDAP://$TargetController/$ComputerDn"
$Group.Add($Computer.path)

该方法需要已经用"LDAP://$TargetController/$ComputerDn"构建的路径，这使得对adsi对象的强制转换是不必要的。