求统计AD组中extensionAttribute4属性值为o365_facstaff的成员数量的PowerShell脚本

Got it, let's fix this for you. Your original script only grabs the total member count because it doesn't check each user's extensionAttribute4 property. Here's a straightforward script that filters members based on that attribute and counts them:

# Replace <group name> with your actual AD group name
$targetGroup = "<group name>"

# Retrieve and filter members:
# 1. Get all members of the group (use -Recursive if you need nested group members)
# 2. Filter out non-user objects (like other groups or computers)
# 3. Fetch the extensionAttribute4 property for each user
# 4. Keep only users where extensionAttribute4 equals o365_facstaff
$qualifiedMembers = Get-AdGroupMember -Identity $targetGroup |
    Where-Object { $_.objectClass -eq "user" } |
    Get-AdUser -Properties extensionAttribute4 |
    Where-Object { $_.extensionAttribute4 -eq "o365_facstaff" }

# Count and display the result
$count = $qualifiedMembers.Count
Write-Host "Total members with extensionAttribute4 = 'o365_facstaff': $count"

Key Notes: #

• Nested Groups: If your AD group contains other groups (nested memberships) and you want to include those users too, add the -Recursive parameter to Get-AdGroupMember (like Get-AdGroupMember -Identity $targetGroup -Recursive).
• Performance: For large groups, this script might take a bit longer since it retrieves each user's attributes individually. If you need a faster approach, you can use an LDAP filter directly with Get-AdUser to target users in the group with the desired attribute:

  # First get the group's distinguished name
  $groupDN = (Get-AdGroup -Identity $targetGroup).DistinguishedName
  # Use LDAP filter to directly fetch qualifying users
  $fastCount = (Get-AdUser -LDAPFilter "(&(memberOf=$groupDN)(extensionAttribute4=o365_facstaff))").Count
  Write-Host "Fast count of qualified members: $fastCount"
  

This should give you the exact count you need!

内容的提问来源于stack exchange，提问作者Programmetry