☰

在 powershell 脚本中排除 OU

tag-icon • tag-icon active-directory powershell
在 powershell 脚本中排除 OU

我有以下脚本：

#Script uses quest powershell commandlets which can be downloaded for free from quest website 
# http://www.quest.com/powershell/activeroles-server.aspx 

#Specify the OU you want to search for inactive accounts 

    $SearchOU=“OU=Sites,DC=nl,DC=example,DC=com" 

#Specify the OU you want to move your inactive computer accounts to 

    #$DestinationOU=“CN=Computers,DC=**,DC=example,DC=com" 

#Specify the number of days that computers have been inactive for 

    $NumOfDaysInactiveFor = 100 

#Specify the description to set on the computer account 

    $Today = Get-Date 

    $Description = "Account disabled due to inactivity on $Today" 

Get-QADComputer -InactiveFor $NumOfDaysInactiveFor -SizeLimit 0 -SearchRoot $searchOU -IncludedProperties ParentContainerDN | foreach {  

    $computer = $_.ComputerName 
    $SourceOU = $_.DN 

    #Remove the commented # from the next line if you want to set the description to be the source OU 
    #$Description = "SourceOU was $SourceOu" 

    Set-QADComputer $computer -Description $Description 

    Disable-QADComputer $computer 

    #Move-QADObject $computer -NewParentContainer $destinationOU  



}

我想要排除 SearchOU 中的一个或多个 OU，这可能吗？我不知道该如何做到这一点。

我使用以下内容SearchOU = OU=Sites,DC=nl,DC=example,DC=com。例如，我想排除以下 OU= OU=Warehouses,OU=*,OU=Sites,DC=*,DC=example,DC=com

答案1

使用该选项，您可以设置区分大小写的 LDAP 搜索过滤器。但据我所知，不支持-LdapFilter 对 DN 进行过滤，例如...(!ou=WareHouses)

典型的方法是嵌套循环，首先，使用一个级别的搜索范围列出 OU，然后在所有名称不匹配的 OU 中执行您想要的搜索*,ou=WareHouses,*

伪代码如下：

for COUNTRY in DC=*.DC=example,DC=com
  do 
    for OrgUnit in OU=*,DC=$COUNTRY,DC=example,DC=com 
      do
        if ( $OrgUnit != *WareHouses* ) {
           Get-QADComputer -SearchRoot $OrgUnit .... 
        }
    done
done

答案2

这是对 HBruijn 的更详细回复。我在下面的代码中添加了一行，过滤掉您指定的“仓库”OU。您可以编辑它以包含多个 OU，或者调整正则表达式以满足您的需求。有很多方法可以做到这一点。

#Specify the OU you want to search for inactive accounts 

$SearchOU=“OU=Sites,DC=nl,DC=example,DC=com" 

#Specify the OU you want to move your inactive computer accounts to 

#$DestinationOU=“CN=Computers,DC=**,DC=example,DC=com" 

#Specify the number of days that computers have been inactive for 

$NumOfDaysInactiveFor = 100 

#Specify the description to set on the computer account 

$Today = Get-Date 

$Description = "Account disabled due to inactivity on $Today" 

Get-QADComputer -InactiveFor $NumOfDaysInactiveFor -SizeLimit 0 -SearchRoot $searchOU -IncludedProperties ParentContainerDN | foreach {  

#Filter out OUs we don't care about

if ( $_.DN -notmatch 'OU=Warehouses,OU=.*,OU=Sites,DC=.*,DC=example,DC=com') {

    $computer = $_.ComputerName 
    $SourceOU = $_.DN 

    #Remove the commented # from the next line if you want to set the description to be the source OU 
    #$Description = "SourceOU was $SourceOu" 

    Set-QADComputer $computer -Description $Description 

    Disable-QADComputer $computer 

    #Move-QADObject $computer -NewParentContainer $destinationOU  
    }
}

答案3

Quest AD cmdlet 曾经很有用。

但现在您可以简单地import-module ActiveDirectory。

然后获取 AD 用户（或计算机等）列表并过滤掉特定 OU 中包含的用户：

$searchou = 'OU=MyOU,DC=domain,DC=com'  
$excludeou = "ouname'

Get-ADUser -filter * -SearchBase $searchou  | where { $_.DistinguishedName
 -notlike $ouname }

相关内容