PowerShell批量删除含大写字符的AD SRV记录失败排查

问题背景 #

以Domain Admin权限使用PowerShell批量删除AD中包含大写字符的SRV记录，替代手动逐个清理。该问题始于将Windows Server 2016加入原有Windows Server 2012及以下版本DC的AD域后。已修正正则表达式和变量问题，但代码仍无法删除符合大写字符条件的记录。实验室环境中已安装Windows Server 2016相关修复补丁并配置组策略防止该问题，但大写SRV记录仍会偶尔重新出现，需排查脚本问题。

最新代码 #

Clear-Host
# DNS zones to examine
$zoneNames = @("_msdcs.alpha.local", "alpha.local")
# DNS server to query
$dnsServer = 'dc2.alpha.local'
# Get all SRV records from the specified zones
$allSrvRecords = foreach ($zoneName in $zoneNames) {
    Get-DnsServerResourceRecord -ZoneName $zoneName -RRType SRV -ComputerName $dnsServer
}
# Array to store deleted records
$deletedRecords = @()

# Iterate through all SRV records
foreach ($record in $allSrvRecords) {
        if ($record.RecordData.DomainName -cmatch '[A-Z]') {
        try { # Attempt to delete the record
            Write-Host "Attempting to delete record: $($record.HostName) in zone $($ZoneName)"
            Remove-DnsServerResourceRecord -Name $record.HostName -RRType $record.RecordType -RecordData $Record.RecordData.DomainName -ZoneName $ZoneName -ComputerName $dnsServer -Force
            $deletedRecords += $record
            Write-Host "Deleted record: $($record.HostName) in zone $ZoneName"
        } catch {
            Write-Host "Error deleting record: $($record.HostName)"
            Write-Host "Error details: $_"
        }
    }
}
# Output results
Write-Host "Deleted records:"
$deletedRecords | ForEach-Object { $_.HostName }

执行结果片段 #

Attempting to delete record: _kerberos._tcp.Site1._sites.dc in zone alpha.local
Error deleting record: _kerberos._tcp.Site1._sites.dc
Error details: InputObject for resource record has an invalid value. Failed to remove the resource record on dc2.alpha.local server. Please check extended error for additional details.
Attempting to delete record: _ldap._tcp.Site1._sites.dc in zone alpha.local
Error deleting record: _ldap._tcp.Site1._sites.dc
Error details: InputObject for resource record has an invalid value. Failed to remove the resource record on dc2.alpha.local server. Please check extended error for additional details.
Attempting to delete record: _kerberos._tcp.Site3._sites.dc in zone alpha.local
Error deleting record: _kerberos._tcp.Site3._sites.dc
Error details: InputObject for resource record has an invalid value. Failed to remove the resource record on dc2.alpha.local server. Please check extended error for additional details.
Attempting to delete record: _ldap._tcp.Site3._sites.dc in zone alpha.local
Error deleting record: _ldap._tcp.Site3._sites.dc
Error details: InputObject for resource record has an invalid value. Failed to remove the resource record on dc2.alpha.local server. Please check extended error for additional details.
Attempting to delete record: _kerberos._tcp.dc in zone alpha.local
Error deleting record: _kerberos._tcp.dc
Error details: InputObject for resource record has an invalid value. Failed to remove the resource record on dc2.alpha.local server. Please check extended error for additional details.

原始数据片段 #

HostName                  RecordType Type       Timestamp            TimeToLive      RecordData                                        
--------                  ---------- ----       ---------            ----------      ----------                                        
_gc._tcp.Site1._sites     SRV        33         3/16/2024 4:00:00 AM 00:10:00        [0][100][3268][DC1.ALPHA.local.]                  
_gc._tcp.Site1._sites     SRV        33         3/14/2024 9:00:00 AM 00:10:00        [0][100][3268][dc1.alpha.local.]                  
_kerberos._tcp.Site1._... SRV        33         3/16/2024 4:00:00 AM 00:10:00        [0][100][88][DC1.ALPHA.local.]                    
_kerberos._tcp.Site1._... SRV        33         3/14/2024 9:00:00 AM 00:10:00        [0][100][88][dc1.alpha.local.]                    
_ldap._tcp.Site1._sites   SRV        33         3/16/2024 4:00:00 AM 00:10:00        [0][100][389][DC1.ALPHA.local.]                   
_ldap._tcp.Site1._sites   SRV        33         3/14/2024 9:00:00 AM 00:10:00        [0][100][389][dc1.alpha.local.]                   
_gc._tcp.Site2._sites     SRV        33         3/14/2024 8:00:00 AM 00:10:00        [0][100][3268][dc2.alpha.local.]                  
_kerberos._tcp.Site2._... SRV        33         3/14/2024 8:00:00 AM 00:10:00        [0][100][88][dc2.alpha.local.]    

问题排查与修复 #

核心问题分析 #

1. 变量作用域错误：$ZoneName在遍历$allSrvRecords时无法正确关联记录所属的DNS区域，因为$allSrvRecords仅存储了记录对象，未保留对应的区域信息。
2. 删除参数错误：Remove-DnsServerResourceRecord的-RecordData参数不能直接传入DomainName字符串，SRV记录的RecordData是包含优先级、权重、端口和域名的完整对象，直接传字符串会导致参数无效。

修正后的代码 #

Clear-Host
# DNS zones to examine
$zoneNames = @("_msdcs.alpha.local", "alpha.local")
# DNS server to query
$dnsServer = 'dc2.alpha.local'
# Get all SRV records from the specified zones, retain zone information
$allSrvRecords = foreach ($zoneName in $zoneNames) {
    Get-DnsServerResourceRecord -ZoneName $zoneName -RRType SRV -ComputerName $dnsServer |
        Select-Object *, @{Name='ZoneName'; Expression={$zoneName}}
}
# Array to store deleted records
$deletedRecords = @()

# Iterate through all SRV records
foreach ($record in $allSrvRecords) {
    if ($record.RecordData.DomainName -cmatch '[A-Z]') {
        try {
            Write-Host "Attempting to delete record: $($record.HostName) in zone $($record.ZoneName)"
            # Use InputObject to directly pass the complete record object
            Remove-DnsServerResourceRecord -InputObject $record -ZoneName $record.ZoneName -ComputerName $dnsServer -Force
            $deletedRecords += $record
            Write-Host "Deleted record: $($record.HostName) in zone $($record.ZoneName)"
        } catch {
            Write-Host "Error deleting record: $($record.HostName)"
            Write-Host "Error details: $_"
        }
    }
}
# Output results
Write-Host "`nDeleted records:"
$deletedRecords | Format-Table HostName, ZoneName, @{Name='TargetDomain'; Expression={$_.RecordData.DomainName}} -AutoSize

关键修改点 #

• 在获取记录时通过Select-Object添加ZoneName属性，确保每个记录对象关联所属的DNS区域。
• 使用-InputObject参数直接传入完整的记录对象进行删除，避免手动构造RecordData的错误。
• 修正变量引用，使用$record.ZoneName替代无效的$ZoneName变量。
• 优化结果输出，展示删除记录的关键信息。

内容的提问来源于stack exchange，提问作者T-Heron