希望有人能帮我解决一段我一直在捣鼓的简单代码。首先我要声明我不是程序员,也从来没有真正用过多少 powershell。
问题是,起初,这是可行的,并按预期返回 LastLogonTimeStamp。
现在,当我运行它时,这一列中根本没有输出。
我很确定这是我忽略的一些愚蠢的事情,但我无法弄清楚。
就像我说的 - 我在这方面确实没有经验 - 我不知道一半的代码是什么意思。
有人可以帮帮我吗?
# Script to list member of VDI Desktop Users Group
# and export details to c:\VDIlastlogon.csv file
# [email protected] 24/11/14'
# Function get-NestedMembers
# List the members of a group including all nested members of subgroups
Import-Module ActiveDirectory
function get-NestedMembers ($group){
if ($group.objectclass[1] -eq 'group') {
write-verbose "Group $($group.cn)"
$Group.member |% {
$de = new-object directoryservices.directoryentry("LDAP://$_")
if ($de.objectclass[1] -eq 'group') {
get-NestedMembers $de
}
Else {
$de
}
}
}
Else {
Throw "$group is not a group"
}
}
# get a group
$group = new-object directoryservices.directoryentry("LDAP://CN=VDI Desktop Users,ou=Groups,ou=x,ou=uk,dc=uk,dc=x,dc=com")
# Get all nested members and send to CSV file
get-NestedMembers $group|FT @{l="First Name";e={$_.givenName}},@{l="Last Name";e={$_.sn}},@{l="Last Logon";e={[datetime]::FromFileTime($_.ConvertLargeItegerToInt64($_.lastLogonTimestamp[0]))}},sAMAccountName | tee c:\VDILastLogon.csv
#Send CSV file to mail recipient
$PSEmailServer = "mail.x.net"
$smtpServer = "mail.x.net"
$file = "c:\VDILastLogon.csv"
$att = new-object Net.Mail.Attachment($file)
$msg = new-object Net.Mail.MailMessage
$smtp = new-object Net.Mail.SmtpClient ($smtpServer)
$msg.From = "[email protected]"
$msg.To.Add("[email protected]")
$msg.Subject = "User logon report from VDI Solution"
$msg.Body = "Please find attached the most recent user logon report"
$msg.Attachments.Add($att)
$smtp.Send($msg)
$att.Dispose()
答案1
如果您导入 AD powershell 模块,则不需要使用额外的 directoryservices 对象(至少在这种情况下不需要)。您可以使用 cmdlet,Get-ADGroupMember
它-Resursive
也应该可以找到您的嵌套用户。
编辑:我-Server
向 AD cmdlet 添加了参数,以便您可以指定特定的 DC。时间戳属性可能不同(它们在我的 12 个 DC 中也不同)。检查这个博客以获得一份像样的写作。
这将获取上次登录时间并且更容易阅读:
$groupname = "name_of_AD_group"
Import-Module ActiveDirectory
Get-ADDomainController -Filter * | % {
$DC = $_
$group = Get-ADGroup -Identity $groupname -Server $DC.Name -ErrorAction SilentlyContinue
If ($group) {
$members = Get-ADGroupMember -Identity $group.Name -Recursive -Server $DC.Name -ErrorAction SilentlyContinue
ForEach ($member In $members) {
If (-not $member.objectClass -ieq "user") { Continue }
$user = Get-ADUser $member.SamAccountName -Server $DC.Name -ErrorAction SilentlyContinue
If ($user) {
$lastlogon = ($user | Get-ADObject -Properties lastLogon).LastLogon
New-Object PSObject -Property @{
"First Name" = $user.GivenName
"Last Name" = $user.Surname
"DC" = $DC.Name
"Last Logon" = [DateTime]::FromFileTime($lastlogon)
"SamAccountName" = $user.SamAccountName
}
} Else {
# $user not found on $DC
}
}
} Else {
# $groupname not found on $DC
}
} | ft -auto
答案2
这是一个 hack,但确实有效。从 Microsoft 文章中获取了 Get-ADUserLastLogon (http://technet.microsoft.com/en-us/library/dd378867%28v=ws.10%29.aspx)
Import-Module ActiveDirectory
function Get-ADUserLastLogon([string]$userName)
{
$dcs = Get-ADDomainController -Filter {Name -like "*"}
$time = 0
foreach($dc in $dcs)
{
$hostname = $dc.HostName
$user = Get-ADUser $userName | Get-ADObject -Properties lastLogon
if($user.LastLogon -gt $time)
{
$time = $user.LastLogon
}
}
$dt = [DateTime]::FromFileTime($time)
return $dt
}
function get-NestedMembers ($group){
if ($group.objectclass[1] -eq 'group') {
write-verbose "Group $($group.cn)"
$Group.member |% {
$de = new-object directoryservices.directoryentry("LDAP://$_")
if ($de.objectclass[1] -eq 'group') {
get-NestedMembers $de
}
Else {
$de
}
}
}
Else {
Throw "$group is not a group"
}
}
# get a group
$group = new-object directoryservices.directoryentry("LDAP://CN=Domain Users,CN=Users,DC=yourdomain,DC=com")
# Get all nested members and send to CSV file
get-NestedMembers $group|FT @{l="First Name";e={$_.givenName}},@{l="Last Name";e={$_.sn}},@{l="Last Logon";e={Get-ADUserLastLogon($_.sAMAccountName)}},sAMAccountName | tee c:\VDILastLogon.csv