将名称相似的WSUS计算机分配至不同目标组的问题

安全阿岳

2026-7-18

WSUS计算机分组脚本问题解决方案

问题核心

名称含xwik的计算机同时匹配wik的筛选条件，先执行wik分组脚本会把这类机器错误移走，导致后续无法分到目标组。以下是两种可行的解决办法：

方法1：调整执行顺序+精确过滤

先处理xwik的机器，再处理wik机器时排除已匹配xwik的条目，确保分组准确：

# 第一步：将含"xwik"的未分配计算机移至DMZ_Patch组
Get-WsusServer | Get-WsusComputer -NameIncludes "xwik" -ComputerTargetGroups "Unassigned Computers" | Add-WsusComputer -TargetGroupName "DMZ_Patch"

# 第二步：将含"wik"但不含"xwik"的未分配计算机移至Friday_Patch组
Get-WsusServer | Get-WsusComputer -NameIncludes "wik" -ComputerTargetGroups "Unassigned Computers" | Where-Object { $_.FullDomainName -notlike "*xwik*" } | Add-WsusComputer -TargetGroupName "Friday_Patch"

方法2：先批量获取未分配机器，再分别筛选分组

先一次性拉取所有未分配计算机，再通过Where-Object精准筛选目标机器，避免重复查询WSUS服务器：

# 连接WSUS服务器并获取所有未分配计算机
$wsusServer = Get-WsusServer
$unassignedComputers = $wsusServer | Get-WsusComputer -ComputerTargetGroups "Unassigned Computers"

# 筛选含"xwik"的机器并分配到DMZ_Patch
$xwikMachines = $unassignedComputers | Where-Object { $_.FullDomainName -match "xwik" }
if ($xwikMachines) {
    $xwikMachines | Add-WsusComputer -TargetGroupName "DMZ_Patch"
}

# 筛选含"wik"但不含"xwik"的机器并分配到Friday_Patch
$wikMachines = $unassignedComputers | Where-Object { $_.FullDomainName -match "wik" -and $_.FullDomainName -notmatch "xwik" }
if ($wikMachines) {
    $wikMachines | Add-WsusComputer -TargetGroupName "Friday_Patch"
}