Active Directory Powershell - forest-wide search script using .csv list of users

问题

I am looking for a bit of help, hope nobody will bash me for being an ignorant. Not that long ago I became something of an AD admin, organisation is big so the tasks vary. I can easily complete what I require via Powershell or snap-ins in most cases. However I have a task on my hands that exceed my "creativity". I have a list of over 10 000 users in .csv which I need to look up in on-premises AD if they exist. My two problems are: -I am very new to scripting and getting increasingly frustrated that I can't comprehend it and make my scripts work as I need them to -Deadline for this task and other responsibilities give me little time to read more on scripting basics and learn. As such I am in most cases forced to look for script snippets on the web and modify them a bit to meet my needs. This worked up until now as the script I have on my hands is a bit too complex for me.

Biggest problem I was facing so far is creating a forest-wide search. My organization have a single root domain and 4 child domains. When running a simple foreach loop a like the one below:

ForEach ($User in (Import-Csv c:\users\public\users.csv))
{ If (Get-ADUser $User.mail -server GLOBALCATALOGADDRESS:xxxx)
{ Write-Host "User found: $($User.mail)"
}
Else
{ Write-Host "User not found: $($User.mail)"
}
}

It searches only domain to which my computer is connected. So I managed to find and modify a forest-wide search script and came up with following:

     #Get Domain List
$objForest = [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()
$DomainList = @($objForest.Domains | Select-Object Name)
$Domains = $DomainList | foreach {$_.Name}
$User = Import-CSV c:\users\public\users.csv
    #Act on each domain
foreach($Domain in ($Domains))
{
Write-Host "Checking $Domain" -fore red
$ADsPath = [ADSI]"LDAP://$Domain"
$objSearcher = New-Object System.DirectoryServices.DirectorySearcher($ADsPath)
    #The filter
Foreach($mail in($User))
{
$objSearcher.Filter = "(&(objectCategory=user)(mail=$User.mail))"
$objSearcher.SearchScope = "Subtree"

$colResults = $objSearcher.FindAll()

foreach ($objResult in $colResults)
    {
    $objArray = $objResult.GetDirectoryEntry()
    write-host $objArray.mail 
    }
}
}

The script seems to be good in its original form (found here: http://powershell.nicoh.me/powershell-1/active-directory/forest-wide-object-searches) and searches well with wildcard and single parameter as filter. However I have no idea what am I missing to make it search for every email address I have in .csv and to make it return information whether or not user with such mail was found. Script itself runs but given the time it takes and blank output it feels like it searches for only one user. I am 100% sure that at least one user from the list exists in on-prem AD. Any suggestions are very welcome. Thanks for your attention.

[EDIT] Final script:

#Get Domain List and load user e-mails from file
$objForest = [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()
$DomainList = @($objForest.Domains | Select-Object Name)
$Domains = $DomainList | foreach {$_.Name}
$Users = Import-CSV c:\users\public\users.csv
#Act on each domain
foreach($Domain in ($Domains))
{
    Write-Host "Checking $Domain" -fore red
    Foreach($mail in ($Users.mail))
    {
      Get-ADUser -filter {mail -eq $mail} -Server $domain -properties mail | select mail
    }
}

回答1:

Do yourself a favour and download AD Powershell module: http://blogs.msdn.com/b/rkramesh/archive/2012/01/17/how-to-add-active-directory-module-in-powershell-in-windows-7.aspx

You will then be able to simplify your code and run things like this, making your task much clearer:

...
foreach($Domain in ($Domains))
{
    Write-Host "Checking $Domain" -fore red
    Foreach($mail in ($User.mail))
    {
        Get-ADUser -filter {mail -eq $mail} -Server $domain -Properties mail | 
        select-object -ExpandProperty mail
    }
}
...

More on AD PS cmdlets: http://technet.microsoft.com/en-us/library/ee617195.aspx

回答2:

Use -LDAPfilter & point the -Server to GC.

Get-ADUser -Server     DC01.Contoso.com:3268
           -Ldapfilter "(ObjectClass=user)(mailnickname=David)"

The above command will search the GC DC01.contoso.com for all the users that their Alias/mailnickname is David.

回答3:

Is is enough to contact the Domain itself instead of a DC of the domain. Thus this shoud also work

get-aduser -Filter {mailnickname -eq "David") -Server contoso.com:3268

来源：https://stackoverflow.com/questions/23754987/active-directory-powershell-forest-wide-search-script-using-csv-list-of-users

标签

powershell

csv

active-directory

subdomain