使用PowerShell将AD用户添加至多组时遇分配异常求助

问题 #

已将用户和组导入Active Directory（AD），现尝试将单个用户添加至多个组（例如让user01加入It、Security、Admin组）。使用的CSV文件结构如下：

Username Group
-------- ------
user01   It;Security;Admin
user02   It
user03   Finance;Hr

用户和组的导入代码可正常运行，但使用Add-ADPrincipalGroupMembership指令分配组权限时，仅能将用户添加至CSV中Group字段的首个组（如user01仅加入It组）。后续补充代码后，运行时提示用户已存在，且执行组分配循环时出现以下警告：

WARNING: Cannot validate argument on parameter 'MemberOf'. The argument is null, empty, or an element of the argument collection contains a null value.

相关代码片段 #

导入CSV

$Csvfile = "path\to\file\users.csv"
$Users = Import-Csv $Csvfile

创建用户循环

# Loop through each user
foreach ($User in $Users) {
    $GivenName = $User.'First name'
    $Surname = $User.'Last name'
    $DisplayName = $User.'Display name'
    $SamAccountName = $User.'Username'
    $UserPrincipalName = $User.'User principal name'
    $OU = $User.'OU'
    $Email = $User.'E-mail'
    $AccountStatus = $User.'Account status'
    $Group = $User.'Group'

    # Check if the user already exists in AD
    $UserExists = Get-ADUser -Filter { SamAccountName -eq 
    $SamAccountName } -ErrorAction SilentlyContinue

    if ($UserExists) {
        Write-Warning "User '$SamAccountName' already exists in Active Directory."
        continue
    }

    # Create new user parameters
    $NewUserParams = @{
        Name                  = "$GivenName $Surname"
        GivenName             = $GivenName
        Surname               = $Surname
        DisplayName           = $DisplayName
        SamAccountName        = $SamAccountName
        UserPrincipalName     = $UserPrincipalName
        Path                  = $OU
        EmailAddress          = $Email
        AccountPassword       = (ConvertTo-SecureString "P@ssw0rd1234" -AsPlainText -Force)
        Enabled               = if ($AccountStatus -eq "Enabled") { $true } else { $false }
        ChangePasswordAtLogon = $true # Set the "User must change password at next logon" flag
    }

    try {
        # Create the new AD user
        New-ADUser @NewUserParams
        Write-Host "User $SamAccountName created successfully." -ForegroundColor Cyan
    }
    catch {
        # Failed to create the new AD user
        Write-Warning "Failed to create user $SamAccountName. $_"
    }
}

组分配循环

$Users | ForEach-Object {
    $addADPrincipalGroupMembershipSplat = @{
        MemberOf = $_.Group.Split(';', [System.StringSplitOptions]::TrimEntries)
        Identity = $_.Username
    }

    try {
        Add-ADPrincipalGroupMembership @addADPrincipalGroupMembershipSplat
    }
    catch {
        Write-Warning $_
    }
}

解决方案 #

1. 修复用户已存在时跳过组分配的逻辑 #

创建用户的循环中，当检测到用户已存在时直接continue，导致这部分用户的组分配完全未执行。需修改逻辑：用户存在时仅跳过创建步骤，保留组分配流程。

修改后的创建用户循环（整合组分配）：

foreach ($User in $Users) {
    # 原有变量定义部分保持不变
    $GivenName = $User.'First name'
    $Surname = $User.'Last name'
    $DisplayName = $User.'Display name'
    $SamAccountName = $User.'Username'
    $UserPrincipalName = $User.'User principal name'
    $OU = $User.'OU'
    $Email = $User.'E-mail'
    $AccountStatus = $User.'Account status'
    $Group = $User.'Group'

    $UserExists = Get-ADUser -Filter { SamAccountName -eq $SamAccountName } -ErrorAction SilentlyContinue

    if ($UserExists) {
        Write-Warning "User '$SamAccountName' already exists in Active Directory."
    } else {
        # 原有的用户创建代码
        $NewUserParams = @{
            Name                  = "$GivenName $Surname"
            GivenName             = $GivenName
            Surname               = $Surname
            DisplayName           = $DisplayName
            SamAccountName        = $SamAccountName
            UserPrincipalName     = $UserPrincipalName
            Path                  = $OU
            EmailAddress          = $Email
            AccountPassword       = (ConvertTo-SecureString "P@ssw0rd1234" -AsPlainText -Force)
            Enabled               = if ($AccountStatus -eq "Enabled") { $true } else { $false }
            ChangePasswordAtLogon = $true
        }
        try {
            New-ADUser @NewUserParams
            Write-Host "User $SamAccountName created successfully." -ForegroundColor Cyan
        }
        catch {
            Write-Warning "Failed to create user $SamAccountName. $_"
        }
    }

    # 无论用户是否新建，都执行组分配
    $groups = $Group.Split(';', [System.StringSplitOptions]::TrimEntries) | Where-Object { $_ -notmatch '^\s*$' }
    if ($groups.Count -gt 0) {
        # 验证组是否存在并收集有效组的可分辨名称
        $validGroups = @()
        foreach ($groupName in $groups) {
            $group = Get-ADGroup -Filter { Name -eq $groupName } -ErrorAction SilentlyContinue
            if ($group) {
                $validGroups += $group.DistinguishedName
            } else {
                Write-Warning "Group '$groupName' does not exist in AD, skipping for user $SamAccountName."
            }
        }

        if ($validGroups.Count -gt 0) {
            try {
                Add-ADPrincipalGroupMembership -Identity $SamAccountName -MemberOf $validGroups -ErrorAction Stop
                Write-Host "Added user $SamAccountName to groups: $($validGroups -join ', ')" -ForegroundColor Green
            }
            catch {
                Write-Warning "Failed to add user $SamAccountName to groups. $_"
            }
        }
    }
}

2. 解决MemberOf参数空值警告 #

• 过滤Split后的空项：使用Where-Object { $_ -notmatch '^\s*$' }移除空白的组名称。
• 验证组的存在性：提前检查CSV中的组是否在AD中存在，避免因组名错误导致的无效操作，同时使用组的可分辨名称作为MemberOf参数值，避免同名组冲突。

3. 独立组分配循环的修复 #

如果要保持组分配逻辑独立，可修改为：

$Users | ForEach-Object {
    $username = $_.Username
    # 先确认用户存在
    $userExists = Get-ADUser -Filter { SamAccountName -eq $username } -ErrorAction SilentlyContinue
    if (-not $userExists) {
        Write-Warning "User '$username' does not exist in AD, skipping group assignment."
        return
    }

    # 拆分并过滤组
    $groups = $_.Group.Split(';', [System.StringSplitOptions]::TrimEntries) | Where-Object { $_ -notmatch '^\s*$' }
    if (-not $groups) {
        Write-Warning "No valid groups found for user '$username'."
        return
    }

    # 收集有效组的DN
    $validGroups = @()
    foreach ($groupName in $groups) {
        $group = Get-ADGroup -Filter { Name -eq $groupName } -ErrorAction SilentlyContinue
        if ($group) {
            $validGroups += $group.DistinguishedName
        } else {
            Write-Warning "Group '$groupName' not found in AD, skipping for user '$username'."
        }
    }

    if ($validGroups.Count -gt 0) {
        try {
            Add-ADPrincipalGroupMembership -Identity $username -MemberOf $validGroups -ErrorAction Stop
            Write-Host "Successfully added user $username to groups: $($validGroups -join ', ')" -ForegroundColor Green
        }
        catch {
            Write-Warning "Failed to add user $username to groups. $_"
        }
    }
}

内容的提问来源于stack exchange，提问作者Kikeman26