如何修改PowerShell脚本，按组成员类型切换Get-MgUser/Get-MgDevice

原脚本可正常获取动态组内的用户成员信息，但无法通过Get-MgDevice返回计算机（设备）成员的信息。问题根源在于原脚本依赖嵌套Try-Catch区分用户和设备，这种方式不仅低效，还可能因权限或API响应问题导致误判。

核心修改思路 #

直接获取组成员的@odata.type属性，通过该属性明确判断成员类型：

• 用户类型标识：#microsoft.graph.user
• 设备类型标识：#microsoft.graph.device
  用Switch分支替代嵌套Try-Catch，精准调用对应API接口，同时保留异常处理应对未知情况。

修改后的完整脚本 #

$GROUP_LIST = Get-MgGroup -Filter "groupTypes/any(c:c eq 'DynamicMembership')" -All:$true | Select-Object Id, DisplayName, Description, GroupTypes

$users = $GROUP_LIST | ForEach-Object {
    $Group = $_
    Write-Host "Processing $($Group.DisplayName)" -ForegroundColor Cyan
    # 获取组成员时包含@odata.type属性，用于判断成员类型
    $members = Get-MgGroupMember -GroupId $Group.Id -Property "id,displayName,@odata.type"

    Write-Host "`t [$($Group.DisplayName)] Member count [$($members.Count)]" -ForegroundColor Yellow

    $members | ForEach-Object {
        $member = $_
        switch ($member.'@odata.type') {
            '#microsoft.graph.user' {
                try {
                    $user = Get-MgUser -UserId $member.Id -Property Id, DisplayName, Mail, UserPrincipalName, CompanyName | 
                            Select-Object Id, DisplayName, Mail, UserPrincipalName, CompanyName

                    [PSCustomObject]@{
                        Group            = $Group.DisplayName
                        Name             = $user.DisplayName
                        USERPRINCIPALNAME = $user.Mail
                        CompanyName      = $user.CompanyName
                    }
                }
                catch {
                    Write-Host "Failed to retrieve user info for ID $($member.Id)" -ForegroundColor Red
                    [PSCustomObject]@{
                        Group            = $Group.DisplayName
                        Name             = $member.DisplayName ?? "Unknown"
                        USERPRINCIPALNAME = "N/A"
                        CompanyName      = "N/A"
                    }
                }
                break
            }
            '#microsoft.graph.device' {
                try {
                    $device = Get-MgDevice -DeviceId $member.Id -Property Id, DisplayName | 
                              Select-Object Id, DisplayName

                    [PSCustomObject]@{
                        Group            = $Group.DisplayName
                        Name             = $device.DisplayName
                        USERPRINCIPALNAME = "N/A"
                        CompanyName      = "N/A"
                    }
                }
                catch {
                    Write-Host "Failed to retrieve device info for ID $($member.Id)" -ForegroundColor Red
                    [PSCustomObject]@{
                        Group            = $Group.DisplayName
                        Name             = $member.DisplayName ?? "Unknown"
                        USERPRINCIPALNAME = "N/A"
                        CompanyName      = "N/A"
                    }
                }
                break
            }
            default {
                Write-Host "Unknown member type $($member.'@odata.type') for ID $($member.Id)" -ForegroundColor Red
                [PSCustomObject]@{
                    Group            = $Group.DisplayName
                    Name             = $member.DisplayName ?? "Unknown"
                    USERPRINCIPALNAME = "N/A"
                    CompanyName      = "N/A"
                }
            }
        }
    }
}

$users | Out-GridView

关键改动说明 #

1. 获取成员类型属性：调用Get-MgGroupMember时添加@odata.type到-Property参数，直接获取成员类型标识，无需依赖异常判断。
2. Switch分支处理：用Switch语句根据成员类型分别调用Get-MgUser或Get-MgDevice，逻辑更清晰高效。
3. 优化异常处理：每个分支内单独处理API调用失败的情况，并优先使用成员列表中已有的displayName作为 fallback，避免显示完全未知的名称。
4. 未知类型兼容：增加默认分支处理未定义的成员类型，输出明确提示。

内容的提问来源于stack exchange，提问作者Senior Systems Engineer