powershell - Get-ADGroupMember : The size limit for this request was exceeded

Question

我正在尝试从文本文件中拉入群组，而我的群组之一太大，可容纳80,000人。

我如何使它工作l，它输出我想要的方式。

$groups = Get-Content c:\temp\ADGroups.txt

foreach($group in $groups) {
    @(Get-ADGroup $group -Properties Member| Select-Object -ExpandProperty Member).Count
    Get-ADGroupMember -Identity $group |
        Get-ADObject -Properties Name, DisplayName |
        Select-Object -Property @{n="Username";e={$_.Name}}, DisplayName,
            @{n="AD Group";e={$group}} |
        Export-Csv C:\Users\Desktop\GroupsInfo.CSV -NoTypeInformation -Append
}

Answer 1

Get-ADGroupMember可返回的对象数受ADWS(Active Directory Web服务)中的限制所限制:

MaxGroupOrMemberEntries

5000

Specifies the maximum number of group members (recursive or non-recursive), group memberships, and authorization groups that can be retrieved by the Active Directory module Get-ADGroupMember, Get-ADPrincipalGroupMembership, and Get-ADAccountAuthorizationGroup cmdlets. Set this parameter to a higher value if you anticipate these cmdlets to return more than 5000 results in your environment.

根据this thread的说法，您应该可以通过查询组对象并扩展其member属性来解决该问题(如果您不能增加服务的限制):

Get-ADGroup $group -Properties Member |
    Select-Object -Expand Member |
    Get-ADUser -Property Name, DisplayName

但是请注意，这可能会很慢，因为您将发送成千上万的请求。建立所有用户的哈希表可能更好:

$users = @{}
Get-ADUser -Filter '*' -Property Name, DisplayName | ForEach-Object {
    $users[$_.DistinguishedName] = $_
}

这样您就可以按其专有名称查找它们:

Get-ADGroup $group -Properties Member |
    Select-Object -Expand Member |
    ForEach-Object { $users[$_] }