我正在使用一个 Powershell 脚本,该脚本将计划任务添加到我们域中的系统。当我运行此脚本时,它会提示我输入密码。有时我会误输入密码,然后进程就会启动,从而锁定我的帐户。有没有办法验证我的凭据,以确保我输入的内容与域相符?
我想找到一种查询域控制器的方法。我在 Google 上搜索过,应该能够执行 WMI 查询并捕获错误。如果可能的话,我想避免这种验证方式。
有什么想法吗?提前致谢。
答案1
我的图书馆里有这个:
$cred = Get-Credential #Read credentials
$username = $cred.username
$password = $cred.GetNetworkCredential().password
# Get current domain using logged-on user's credentials
$CurrentDomain = "LDAP://" + ([ADSI]"").distinguishedName
$domain = New-Object System.DirectoryServices.DirectoryEntry($CurrentDomain,$UserName,$Password)
if ($domain.name -eq $null)
{
write-host "Authentication failed - please verify your username and password."
exit #terminate the script.
}
else
{
write-host "Successfully authenticated with domain $domain.name"
}
答案2
这是我过去使用过的;它应该适用于本地机器帐户和“应用程序目录”,但到目前为止,我仅使用 AD 凭据成功使用它:
function Test-Credential {
<#
.SYNOPSIS
Takes a PSCredential object and validates it against the domain (or local machine, or ADAM instance).
.PARAMETER cred
A PScredential object with the username/password you wish to test. Typically this is generated using the Get-Credential cmdlet. Accepts pipeline input.
.PARAMETER context
An optional parameter specifying what type of credential this is. Possible values are 'Domain','Machine',and 'ApplicationDirectory.' The default is 'Domain.'
.OUTPUTS
A boolean, indicating whether the credentials were successfully validated.
#>
param(
[parameter(Mandatory=$true,ValueFromPipeline=$true)]
[System.Management.Automation.PSCredential]$credential,
[parameter()][validateset('Domain','Machine','ApplicationDirectory')]
[string]$context = 'Domain'
)
begin {
Add-Type -assemblyname system.DirectoryServices.accountmanagement
$DS = New-Object System.DirectoryServices.AccountManagement.PrincipalContext([System.DirectoryServices.AccountManagement.ContextType]::$context)
}
process {
$DS.ValidateCredentials($credential.UserName, $credential.GetNetworkCredential().password)
}
}
答案3
我发现这篇文章很有用,但它没有解决我的问题,因为我试图从登录本地管理员帐户的脚本运行它。它似乎无法以本地管理员身份运行(仅当以域用户身份登录时)。
不过,我最终还是设法找到了一个可行的解决方案,由于这太麻烦了,我想在这里分享一下,这样遇到这个问题的人就可以在这里找到答案。根据您的需要,两个答案都放在一个页面上。
请注意,在脚本的上部(这里不包括,因为这只是 get-credentials 部分)安装了 powergui,并且是下面代码的必需项(以及“Add-PSSnapin Quest.ActiveRoles.ADManagement”行)。不确定 powergui 做了什么不同的事情,但没有人能告诉我,而且它确实有效。
在“domain_name”部分中替换您自己的域名。
#Get credentials
$credential_ok = 0
while ($credential_ok -ne 1)
{
$credential = get-credential
$result = connect-qadservice -service *domain_name* -credential $credential
[string]$result_string = $result.domain
if ($result_string -eq "*domain_name*")
{
$credential_ok = 1
#authenticated
}
else
{
#failed
}
}
$username = $credential.username
$password = $credential.GetNetworkCredential().password
$date = get-date
Add-Content "c:\lbin\Install_log.txt" "Successfully authenticated XP script as $username $date"
答案4
(还有)另一个版本:
param([string]$preloadServiceAccountUserName = "")
function HarvestCredentials()
{
[System.Management.Automation.PSCredential]$credentialsOfCurrentUser = Get-Credential -Message "Please enter your username & password" -UserName $preloadServiceAccountUserName
if ( $credentialsOfCurrentUser )
{
$credentialsOfCurrentUser = $credentialsOfCurrentUser
}
else
{
throw [System.ArgumentOutOfRangeException] "Gui credentials not entered correctly"
}
Try
{
# see https://msdn.microsoft.com/en-us/library/system.directoryservices.directoryentry.path(v=vs.110).aspx
# validate the credentials are legitimate
$validateCredentialsTest = (new-object System.DirectoryServices.DirectoryEntry ("WinNT://"+$credentialsOfCurrentUser.GetNetworkCredential().Domain), $credentialsOfCurrentUser.GetNetworkCredential().UserName, $credentialsOfCurrentUser.GetNetworkCredential().Password).psbase.name
if ( $null -eq $validateCredentialsTest)
{
throw [System.ArgumentOutOfRangeException] "Credentials are not valid. ('" + $credentialsOfCurrentUser.GetNetworkCredential().Domain + '\' + $credentialsOfCurrentUser.GetNetworkCredential().UserName + "')"
}
else
{
$t = $host.ui.RawUI.ForegroundColor
$host.ui.RawUI.ForegroundColor = "Magenta"
Write-Output "GOOD CREDENTIALS"
$host.ui.RawUI.ForegroundColor = $t
}
}
Catch
{
$ErrorMessage = $_.Exception.Message
$FailedItem = $_.Exception.ItemName
$StackTrace = $_.Exception.StackTrace
$t = $host.ui.RawUI.ForegroundColor
$host.ui.RawUI.ForegroundColor = "Red"
Write-Output "Exception - $ErrorMessage"
Write-Output "Exception - $FailedItem"
Write-Output "Exception - $StackTrace"
$host.ui.RawUI.ForegroundColor = $t
throw [System.ArgumentOutOfRangeException] "Attempt to create System.DirectoryServices.DirectoryEntry failed. Most likely reason is that credentials are not valid."
}
}
Try
{
HarvestCredentials
}
Catch
{
$ErrorMessage = $_.Exception.Message
$FailedItem = $_.Exception.ItemName
$StackTrace = $_.Exception.StackTrace
$t = $host.ui.RawUI.ForegroundColor
$host.ui.RawUI.ForegroundColor = "Red"
Write-Output "Exception - " + $ErrorMessage
Write-Output "Exception - " + $FailedItem
Write-Output "Exception - " + $StackTrace
$host.ui.RawUI.ForegroundColor = $t
Break
}
Finally
{
$Time=Get-Date
Write-Output "Done - " + $Time
}
和
.\TestCredentials.ps1 -preloadServiceAccountUserName "mydomain\myusername"