powershell - get-adgroupmember - 当组有来自不同域的成员时失败。

Question

例如。我在 domainA.local 上。我运行这个命令。

get-adgroupmember -Identity groupA

如果该组的任何成员属于另一个域(domainB\user 等)，则它会失败并显示此消息。

get-adgroupmember : The server was unable to process the request due to an internal error.  For more information about
the error, either turn on IncludeExceptionDetailInFaults (either from ServiceBehaviorAttribute or from the
<serviceDebug> configuration behavior) on the server in order to send the exception information back to the client, or
turn on tracing as per the Microsoft .NET Framework 3.0 SDK documentation and inspect the server trace logs.
At line:1 char:1
+ get-adgroupmember -Identity groupA
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (groupA:ADGroup) [Get-ADGroupMember], ADException
    + FullyQualifiedErrorId : The server was unable to process the request due to an internal error.  For more informa
   tion about the error, either turn on IncludeExceptionDetailInFaults (either from ServiceBehaviorAttribute or from
  the <serviceDebug> configuration behavior) on the server in order to send the exception information back to the cl
 ient, or turn on tracing as per the Microsoft .NET Framework 3.0 SDK documentation and inspect the server trace lo
gs.,Microsoft.ActiveDirectory.Management.Commands.GetADGroupMember

关于如何解决这个问题的任何想法？作为今天的解决方法，我的组中只有一个用户来自另一个域，所以我只是删除了他们，运行我的脚本，然后将它们放回去。所以我很肯定它会因为这个原因而失败。任何帮助将非常感激。

Answer 1

如果他们在不同的域中，并且您对该域具有权限，请尝试使用 try/catch 循环，如下例所示。使用 try/catch，您可以告诉 PowerShell 尝试{} 代码块，如果出现错误，请不要终止脚本，而是使用 catch{} 并运行另一个代码块。

$DomainBCreds = get-credential
  try {get-adgroupmember -Identity groupA -ErrorAction Stop}
catch {Get-AdGroupMember -Identity GroupA -Credential DomainB}

或者，如果您只想让命令继续运行，即使出现错误，也可以运行 Get-ADGroupMember ... -ErrorAction SilentlyContinue，但这不是最佳做法。