powershell - 使用Powershell过滤get-adobject

Question

有人可以告诉我查询的问题。

我想撤回不在多个特定OU中的所有用户，我认为以下查询将起作用，但是如您所见，它撤回了DN中带有“ou = staff”的用户(从所有输出)。

我想说的是DN属性中是否没有以下内容。

$NotinDirectory = Get-ADObject  -LDAPFilter "objectClass=person" -SearchBase "OU=Accounts,DC=Company,DC=ac,DC=uk" -Properties ou |? {($_.DistinguishedName -notlike "*Agency*" -and "*Contractors*" -and "*Fellows*" -and "*Visitors*" -and "*ou=Staff*" -and "*Contacts*")}

CN = jo Blogs，OU = Staff，OU = Accounts，DC = compnay，DC = ac，DC = uk

更新
所以我根据下面的评论尝试了

 $NotinDirectory = Get-ADObject  -LDAPFilter "objectClass=person" -SearchBase "OU=Accounts,OU=iah,DC=iah,DC=ac,DC=uk"  | ? {($_DistinguishedName -notlike "*Agency*" -and $_DistinguishedName -notlike "*Contractors*" -and $_DistinguishedName -notlike "*Fellows*" ) -and ($_DistinguishedName -notlike"*Visitors*") -and ($_DistinguishedName -notlike"*OU=Staff*" -and $_DistinguishedName -notlike"*Contacts*")}
foreach ($test in $NotinDirectory){ Write-Host $test.DistinguishedName}

但我仍然得到
CN = xxx xxxxx，OU =职员，OU =帐户，DC =公司，DC = ac，DC =英国

Answer 1

在Where-Object过滤器中:

($_.DistinguishedName -notlike "*Agency*" -and "*Contractors*" -and "*Fellows*" -and "*Visitors*" -and "*ou=Staff*" -and "*Contacts*")

您只在第一次( $_.DistinguishedName)一次将 -notlike "*Agency*"与一个字符串进行比较。

它将解析如下:

(($_.DistinguishedName -notlike "*Agency*") -and ("*Contractors*") -and ("*Fellows*") -and ("*Visitors*") -and ("*ou=Staff*") -and ("*Contacts*"))
(($_.DistinguishedName -notlike "*Agency*") -and $true -and $true -and $true -and $true -and $true)
($_.DistinguishedName -notlike "*Agency*")

您必须执行以下操作:

Get-ADObject | Where-Object {($_.DistinguishedName -notlike "*Agency*" -and 
    $_.DistinguishedName -notlike "*Contractors*" -and 
    $_.DistinguishedName -notlike "*Fellows*" -and 
    $_.DistinguishedName -notlike "*Visitors*" -and 
    $_.DistinguishedName -notlike "*ou=Staff*" -and 
    $_.DistinguishedName -notlike "*Contacts*")}

为了测试所有6个字符串。

如果您要排除的字符串数量可变，则可以在 ForEach-Object中使用 Where-Object:

$Excludes = "*Agency*","*Contractors*","*Fellows*","*Visitors*","*ou=Staff*","*Contacts*"

Get-ADObject |Where-Object {
    $ADObj = $_
    @($Excludes |ForEach-Object {
        $ADObj.DistinguishedName -notlike $_
    }) -notcontains $false
}