英文:
How to add AD group to a user in another domain
问题
I am writing a script to add a group to users from a different domain. My script is as follows:
$User = Get-ADUser -Identity "testuser1" -Server testserver1
$Group = Get-ADGroup -Identity "testgroup" -Server testserver2
add-content $logfile "$logfileTime :: The AD User : $User"
add-content $logfile "$logfileTime :: The group : $Group"
try
{
$addMember = Add-ADGroupMember -identity "$Group" -Members "$User"
}
catch
{
add-content $logfile "Add Member Error : $_.Exception.Message"
}
But I am getting the following error in my log file:
2023-04-11 11:10:30 :: The AD User : CN=testuser1,OU=Test,DC=XXX,DC=XXX,DC=XXX
2023-04-11 11:10:30 :: The group : CN=testgroup,OU=test,DC=YYY,DC=YYY,DC=YYY
Add Member Error : Cannot find an object with identity:'CN=testuser1,OU=Test,DC=XXX,DC=XXX,DC=XXX' under: 'DC=YYY,DC=YYY,DC=YYY'..Exception.Message
If I tried my script for adding the same group to the user from the same domain as where the group is located, it manages to add the group to the user. I had followed the link but it seems like it's not working as expected.
英文:
I am writing a script to add group to user that were from different domain. My script as below :
<br><Br>
$User = Get-ADUser -Identity "testuser1" -Server testserver1
$Group = Get-ADGroup -Identity "testgroup" -Server testserver2
add-content $logfile "$logfileTime :: The AD User : $User"
add-content $logfile "$logfileTime :: The group : $Group"
try
{
$addMember = Add-ADGroupMember -identity "$Group" -Members "$User"
}
catch
{
add-content $logfile "Add Member Error : $_.Exception.Message"
}
<br><Br>
But I am getting the following error in my log file <bR><br>
2023-04-11 11:10:30 :: The AD User : CN=testuser1,OU=Test,DC=XXX,DC=XXX,DC=XXX
2023-04-11 11:10:30 :: The group : CN=testgroup,OU=test,DC=YYY,DC=YYY,DC=YYY
Add Member Error : Cannot find an object with identity:'CN=testuser1,OU=Test,DC=XXX,DC=XXX,DC=XXX' under: 'DC=YYY,DC=YYY,DC=YYY'..Exception.Message
If I tried my script for adding the same group to the user from same domain as where the group is locate, Its managed to add the group to the user <br><br> I had followed the link but seem like its not working as expected
答案1
得分: 0
使用PowerShell AD cmdlets时，每当你的目标是与计算机加入的域不同的域时，你必须使用-Server参数。
在使用Add-ADGroupMember时，你是将用户添加到组的member属性中，这意味着你修改的是组，而不是用户。因此，你必须在域上使用-Server参数。
此外，你无需在数值周围使用引号。
而将返回值分配给$addMember 是毫无意义的。它不返回任何内容，除非你使用-PassThru参数。
将所有这些内容组合在一起，你可以将该行更改为：
Add-ADGroupMember -Identity $Group -Members $User -Server testserver2
英文:
With all of the PowerShell AD cmdlets, you have to use the -Server parameter every time you are targeting a domain other than the one that the computer is joined to.
When you use Add-ADGroupMember, you are adding the user to the member attribute of the group, which means you are modifying the group, not the user. So you have to use the -Server parameter with the domain of the group.
You also don't need to use quotes around the values.
And assigning the return value to $addMember is pointless. It doesn't return anything unless you use the -PassThru parameter.
Putting that all together, you can change that line to this:
Add-ADGroupMember -Identity $Group -Members $User -Server testserver2
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库，让每个人都能够通过互相帮助和分享经验来进步。
评论