PowerShell：CSV筛选禁用用户并从AD安全组移除脚本故障排查

我正在编写PowerShell脚本实现以下功能：

1. 导入包含活跃/非活跃账户的CSV文件，通过关键词“Disabled”筛选用户，生成带时间戳的无表头审计CSV文件；
2. 将筛选出的用户从指定AD安全组中移除，匹配逻辑为CSV中的Email对应AD用户的UPN。

但执行移除组的脚本时持续报错，比如“找不到-like/-eq参数”，修改后又出现$UPN未定义的问题，脚本存在语法及CSV导入相关错误，请求排查解决。

注：实际域环境中，禁用用户分布在多个OU（如Test>Users>Terminated），需移除的组已定义在$GroupFilter变量中。

原脚本片段 #

导入并筛选用户的脚本

Import-Module -Name ActiveDirectory

# Gathers Date information and creates CSV naming convention for Filtered CSV Output
$TimeStamp = Get-date -Format "MMddyy"
$filters = "Disabled"

# User drops file named Removal to Desktop
Get-Content -Path 'c:\Scripts\UsersTest.csv' | Select-String -Pattern $filters | Out-File -FilePath "c:\Logs\$TimeStamp FilteredUsersForRemoval.csv"

移除组的初始脚本

$GroupFilter = 'MFA Offline Access', 'Personal Phone', 'MFAUsers', 'Test Domain 1 users', 'Test Domain 2 Users'
$Users= "c:\Logs\$TimeStamp FilteredUsersForRemoval.csv"

foreach ($User in $Users)
{
    $UPN = $User.Username
    $ADUser = Get-ADUser -Filter 'Email' -like $UPN | Select-Object SamAccountName
    {
        $ExistingGroups = Get-ADPrincipalGroupMembership $ADUser.SamAccountName | Select-Object Name
        if ($ExistingGroups.Name -eq $GroupFilter)
            {
                Remove-ADGroupMember -Identity $GroupFilter-Members $ADUser.SamAccountName -Confirm$false
                Write-Host "Removed $UPN from $Group" - ForeGroundColor Green
            }
        else
            {
                Write-Host "$UPN does not exist in $Group" - ForeGroundColor Yellow
            }
    }
}

修改后的脚本

foreach ($User in $Users)
{
    $UPN = $User.Email
    $ADUser = Get-ADUser -Filter {Email -like $UPN} | Select-Object UserPrincipalName 
    {
        $ExistingGroups = Get-ADPrincipalGroupMembership $ADUser.UserPrincipalName  | Select-Object Name
        if ($ExistingGroups[0].Name -eq $GroupFilter)
            {
                Remove-ADGroupMember -Identity $GroupFilter-Members $ADUser.UserPrincipalName
                Write-Host "Removed $UPN from $Group" - ForeGroundColor Green
            }
        else
            {
                Write-Host "$UPN does not exist in $Group" - ForeGroundColor Yellow
            }
    }
}

错误点分析 #

• CSV读取逻辑错误：$Users = "文件路径"仅赋值字符串，未读取CSV内容，foreach循环实际遍历的是字符串的每个字符，而非用户对象，导致无法获取$User.Email属性
• AD筛选语法错误：Get-ADUser的Filter参数格式错误，正确格式应为{EmailAddress -like $UPN}（注意AD用户属性名为EmailAddress而非Email）；初始脚本中-Filter 'Email' -like $UPN属于参数滥用
• 冗余代码块：Get-ADUser后多余的{}属于无效语法，导致脚本执行异常
• 组匹配逻辑错误：$ExistingGroups.Name -eq $GroupFilter是单值与多值数组的错误比较，且未遍历$GroupFilter中的每个组
• Cmdlet参数错误：Remove-ADGroupMember的参数格式错误，-Identity $GroupFilter-Members应为-Identity $Group -Members $ADUser，且-Confirm:$false需添加冒号
• 空值未处理：未判断Get-ADUser是否找到用户，若返回空值会导致后续操作报错

修复后的完整脚本 #

1. 优化后的导入筛选脚本

Import-Module ActiveDirectory

$TimeStamp = Get-Date -Format "MMddyy"
$sourceCsvPath = "c:\Scripts\UsersTest.csv"
$outputCsvPath = "c:\Logs\$TimeStamp FilteredUsersForRemoval.csv"

# 导入CSV并筛选包含Disabled的行，导出无表头的CSV
Import-Csv -Path $sourceCsvPath | Where-Object { $_ -match "Disabled" } | 
    ConvertTo-Csv -NoTypeInformation | Select-Object -Skip 1 | 
    Out-File -FilePath $outputCsvPath -Encoding utf8

2. 修复后的组移除脚本

Import-Module ActiveDirectory

$TimeStamp = Get-Date -Format "MMddyy"
$filteredCsvPath = "c:\Logs\$TimeStamp FilteredUsersForRemoval.csv"
$GroupFilter = 'MFA Offline Access', 'Personal Phone', 'MFAUsers', 'Test Domain 1 users', 'Test Domain 2 Users'

# 读取筛选后的CSV（无表头，需指定列名，根据实际CSV列数调整Header）
$users = Import-Csv -Path $filteredCsvPath -Header "Email", "Status", "OtherColumns"

foreach ($user in $users) {
    $upn = $user.Email.Trim()
    if (-not $upn) { continue } # 跳过空邮箱

    # 查找AD用户（用EmailAddress匹配UPN）
    $adUser = Get-ADUser -Filter { EmailAddress -eq $upn } -Properties MemberOf -ErrorAction SilentlyContinue
    if (-not $adUser) {
        Write-Host "未找到AD用户：$upn" -ForegroundColor Red
        continue
    }

    # 获取用户当前所属组
    $userGroups = Get-ADPrincipalGroupMembership -Identity $adUser.SamAccountName | Select-Object -ExpandProperty Name

    foreach ($group in $GroupFilter) {
        if ($userGroups -contains $group) {
            try {
                Remove-ADGroupMember -Identity $group -Members $adUser.SamAccountName -Confirm:$false -ErrorAction Stop
                Write-Host "已将 $upn 从组 $group 移除" -ForegroundColor Green
            }
            catch {
                Write-Host "移除 $upn 到组 $group 失败：$_" -ForegroundColor Red
            }
        }
        else {
            Write-Host "$upn 不在组 $group 中" -ForegroundColor Yellow
        }
    }
}

内容的提问来源于stack exchange，提问作者Trikru502