☰

Powershell 脚本不起作用

tag-icon • tag-icon powershell
Powershell 脚本不起作用

我有这个脚本，可以基于计算机的子网移动计算机，但是我不断收到以下错误，我无论如何也找不到问题所在。

我可以使用 move-adobject 手动移动计算机。

错误：

Move-ADObject : The operation could not be performed because the object's parent is either uninstantiated or deleted
At C:\tools\move_computers_ad_subnet.ps1:179 char:22
+         Move-ADObject <<<<  -Identity $ComputerDN -TargetPath $DestinationDN
    + CategoryInfo          : NotSpecified: (CN=DS-RECEPTION...nta,DC=co,DC=uk:ADObject) [Move-ADObject], ADException
    + FullyQualifiedErrorId : The operation could not be performed because the object's parent is either uninstantiate
   d or deleted,Microsoft.ActiveDirectory.Management.Commands.MoveADObject

脚本

################################################################################ 
# PowerShell routine to move Windows 7 Computers into OU structure based on IP # 
################################################################################ 

# Requires Active Directory 2008 R2 and the PowerShell ActiveDirectory module 



##################### 
# Environment Setup # 
##################### 

#Add the Active Directory PowerShell module 
Import-Module ActiveDirectory 

#Set the threshold for an "old" computer which will be moved to the Disabled OU 
$old = (Get-Date).AddDays(-110) # Modify the -60 to match your threshold  

#Set the threshold for an "very old" computer which will be deleted 
$veryold = (Get-Date).AddDays(-120) # Modify the -90 to match your threshold  


############################## 
# Set the Location IP ranges # 
############################## 

$LyricSqIP = "\b(?:(?:10)\.)" + "\b(?:(?:21)\.)" + "\b(?:(?:2)\.)" + "\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?))" # 10.21.2.0/24 



######################## 
# Set the Location OUs # 
######################## 

# Disabled OU 
$DisabledDN = "OU=_Disabled,OU=Computers,OU=Avanta_UK,OU=_Avanta_Group,DC=avanta,DC=co,DC=uk" 

# OU Locations 
$LyricSqDN = "OU=Hammersmith,OU=Computers,OU=Avanta_UK,OU=_Avanta_Group,DC=avanta,DC=co,DC=uk" 

############### 
# The process # 
############### 

# Query Active Directory for Computers running Windows 7 or XP (Any version) and move the objects to the correct OU based on IP 
Get-ADComputer -Filter {(Name -notlike "*-security*" ) -and (OperatingSystem -like "Windows 7*" -or OperatingSystem -like "Windows XP*")}  -Properties PasswordLastSet | ForEach-Object { 

    # Ignore Error Messages and continue on 
    trap [System.Net.Sockets.SocketException] { continue; } 

    # Set variables for Name and current OU 
    $ComputerName = $_.Name 
    $ComputerDN = $_.distinguishedName 
    $ComputerPasswordLastSet = $_.PasswordLastSet 
    $ComputerContainer = $ComputerDN.Replace( "CN=$ComputerName," , "") 

    # If the computer is more than 90 days off the network, remove the computer object 
    if ($ComputerPasswordLastSet -le $veryold) {  
        Remove-ADObject -Identity $ComputerDN -WhatIf
    } 

    # Check to see if it is an "old" computer account and move it to the Disabled\Computers OU 
    if ($ComputerPasswordLastSet -le $old) {  
        $DestinationDN = $DisabledDN 
        Move-ADObject -Identity $ComputerDN -TargetPath $DestinationDN -WhatIf
    } 

    # Query DNS for IP  
    # First we clear the previous IP. If the lookup fails it will retain the previous IP and incorrectly identify the subnet 
    $IP = $NULL 
    $IP = [System.Net.Dns]::GetHostAddresses("$ComputerName") 

    # Use the $IPLocation to determine the computer's destination network location 
    # 
    # 
    if ($IP -match $LyricSqIP) { 
        $DestinationDN = $LyricSqDN 
    } 

    Else { 
        # If the subnet does not match we should not move the computer so we do Nothing 
        $DestinationDN = $TestDN   
    } 

    # Move the Computer object to the appropriate OU 
    # If the IP is NULL we will trust it is an "old" or "very old" computer so we won't move it again 
    if ($IP -ne $NULL) { 
        Move-ADObject -Identity $ComputerDN -TargetPath $DestinationDN -WhatIf
    } 
}

答案1

如果计算机帐户超过 120 天没有设置密码，你的脚本首先会删除该帐户，然后然后尝试删除它：

# If the computer is more than 90 days off the network, remove the computer object 
if ($ComputerPasswordLastSet -le $veryold) { # $TRUE
    Remove-ADObject -Identity $ComputerDN -WhatIf
} 

# Check to see if it is an "old" computer account and move it to the Disabled\Computers OU 
if ($ComputerPasswordLastSet -le $old) { # ALSO $TRUE
    $DestinationDN = $DisabledDN 
    Move-ADObject -Identity $ComputerDN -TargetPath $DestinationDN -WhatIf
}

确保$DisabledDN和$LyricSqDN包含正确的 DN，并且 OU 存在。

您可以使用以下方法测试它们的存在：

[ADSI]::Exists($DisabledDN)
[ADSI]::Exists($LyricSqDN)

相关内容