PowerShell中Get-ADUser用636端口失败，但DirectorySearcher可正常运行

我有一个PowerShell脚本，用于从VirtualBox中托管的Active Directory服务器获取用户信息。已将根证书导入计算机的受信任根存储，可通过JXplorer使用389和636（SSL）端口连接并查询AD服务器。

脚本内容 #

Get-ADUser -AuthType 0 -LDAPFilter "(objectClass=user)" -SearchBase "CN=Users,DC=win2022,DC=kcwong,DC=igsl" -Server "WIN-EF20VIM8EIQ.win2022.kcwong.igsl:636" -Credential "Administrator"
# Password is entered correctly in the dialog that pops up

$LDAP = New-Object System.DirectoryServices.DirectoryEntry("LDAP://WIN-EF20VIM8EIQ.win2022.kcwong.igsl:636/CN=Users,DC=win2022,DC=kcwong,DC=igsl", "Administrator", "[Password here]")
$Searcher = New-Object System.DirectoryServices.DirectorySearcher($LDAP)
$Searcher.SearchScope = "Subtree"
$Searcher.Filter = "(objectClass=user)"
$Searcher.FindAll()

执行结果 #

PS C:\KC\Projects\Fubon Bank\Script> .\LDAPExport.ps1
Get-ADUser : Server instance not found on the given port.
At C:\KC\Projects\Fubon Bank\Script\LDAPExport.ps1:69 char:1
+ Get-ADUser -AuthType 0 -LDAPFilter "(objectClass=user)" -SearchBase " ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidArgument: (:) [Get-ADUser], ArgumentException
    + FullyQualifiedErrorId : ActiveDirectoryCmdlet:System.ArgumentException,Microsoft.ActiveDirectory.Management.Commands.GetADUser


Path                                                                                                  Properties
----                                                                                                  ----------
LDAP://WIN-EF20VIM8EIQ.win2022.kcwong.igsl:636/CN=Administrator,CN=Users,DC=win2022,DC=kcwong,DC=igsl {logoncount, c...
LDAP://WIN-EF20VIM8EIQ.win2022.kcwong.igsl:636/CN=Guest,CN=Users,DC=win2022,DC=kcwong,DC=igsl         {logoncount, c...
LDAP://WIN-EF20VIM8EIQ.win2022.kcwong.igsl:636/CN=krbtgt,CN=Users,DC=win2022,DC=kcwong,DC=igsl        {logoncount, c...
LDAP://WIN-EF20VIM8EIQ.win2022.kcwong.igsl:636/CN=test1,CN=Users,DC=win2022,DC=kcwong,DC=igsl         {givenname, co...
LDAP://WIN-EF20VIM8EIQ.win2022.kcwong.igsl:636/CN=test2,CN=Users,DC=win2022,DC=kcwong,DC=igsl         {givenname, co...
LDAP://WIN-EF20VIM8EIQ.win2022.kcwong.igsl:636/CN=test10,CN=Users,DC=win2022,DC=kcwong,DC=igsl        {givenname, co...

PS C:\KC\Projects\Fubon Bank\Script>

补充说明 #

• DirectorySearcher可正常运行，但Get-ADUser通过636端口连接时失败
• 改用389端口时Get-ADUser可正常工作
• 不想使用DirectoryEntry，因为脚本将在任务计划程序中执行，需要保护密码；虽已找到通过凭据文件为ADSI提供凭据的方法，但仍希望解决Get-ADUser的SSL连接问题。

内容的提问来源于stack exchange，提问作者KC Wong