求跨域（Prod至Test）导出导入OU结构、AD用户、组及组成员的完整PowerShell脚本

我刚好做过类似的跨域AD迁移需求，整理了一套完整的PowerShell脚本，涵盖OU结构、用户（全属性）、组和组成员的导出导入，密码无法迁移的情况也考虑到了，你可以参考下面的内容：

• 导出操作需要在**生产域（Prod）**的域控制器或已加入Prod域的机器上执行，且账号需具备AD读取权限
• 导入操作需要在**测试域（Test）**的域控制器或已加入Test域的机器上执行，且账号需具备AD写入权限
• 密码无法跨域迁移，导入后用户需要重置初始密码
• 所有导出数据会保存到指定路径，建议提前创建好文件夹（比如C:\ADMigration）

先设置基础变量，你可以根据实际情况修改：

$sourceDomain = "Prod.com"
$exportPath = "C:\ADMigration"

# 确保导出目录存在
if (-not (Test-Path $exportPath)) {
    New-Item -ItemType Directory -Path $exportPath | Out-Null
}

1. 导出OU结构 #

# 导出所有OU（排除默认的Domain Controllers）
Get-ADOrganizationalUnit -Filter * -SearchBase "DC=Prod,DC=com" -SearchScope Subtree -Properties * | 
    Where-Object { $_.Name -ne "Domain Controllers" } |
    Select-Object DistinguishedName, Name, Description, ManagedBy, StreetAddress, City, State, PostalCode, Country |
    Export-Csv -Path "$exportPath\OU_Export.csv" -NoTypeInformation -Encoding UTF8

Write-Host "OU结构导出完成，文件路径：$exportPath\OU_Export.csv"

2. 导出带全属性的AD用户 #

# 导出所有用户（排除系统用户，可根据实际调整过滤规则）
Get-ADUser -Filter * -SearchBase "DC=Prod,DC=com" -SearchScope Subtree -Properties * |
    Where-Object { $_.Enabled -eq $true -and $_.SamAccountName -notlike "*$*" } |
    Select-Object * |
    Export-Csv -Path "$exportPath\Users_Export.csv" -NoTypeInformation -Encoding UTF8

Write-Host "用户全属性导出完成，文件路径：$exportPath\Users_Export.csv"

3. 导出组及组成员信息 #

# 导出组基础信息
Get-ADGroup -Filter * -SearchBase "DC=Prod,DC=com" -SearchScope Subtree -Properties * |
    Select-Object DistinguishedName, Name, SamAccountName, GroupCategory, GroupScope, Description |
    Export-Csv -Path "$exportPath\Groups_Export.csv" -NoTypeInformation -Encoding UTF8

# 导出组成员映射关系
$groupMembers = @()
Get-ADGroup -Filter * -SearchBase "DC=Prod,DC=com" -SearchScope Subtree | ForEach-Object {
    $groupDN = $_.DistinguishedName
    Get-ADGroupMember -Identity $_ | ForEach-Object {
        $groupMembers += [PSCustomObject]@{
            GroupDN = $groupDN
            MemberDN = $_.DistinguishedName
            MemberSamAccountName = $_.SamAccountName
        }
    }
}
$groupMembers | Export-Csv -Path "$exportPath\GroupMembers_Export.csv" -NoTypeInformation -Encoding UTF8

Write-Host "组及组成员信息导出完成，文件路径：$exportPath\Groups_Export.csv 和 $exportPath\GroupMembers_Export.csv"

同样先设置基础变量：

$targetDomain = "Test.com"
$importPath = "C:\ADMigration" # 和导出路径一致，确保文件已复制到Test域机器

1. 导入OU结构 #

$ous = Import-Csv -Path "$importPath\OU_Export.csv" -Encoding UTF8

foreach ($ou in $ous) {
    # 拆分OU的父路径
    $parentDN = $ou.DistinguishedName -replace "^OU=$($ou.Name),", ""
    # 检查父OU是否存在（导出时OU默认按层级排序，所以父OU应该先被处理）
    if (-not (Get-ADOrganizationalUnit -Filter "DistinguishedName -eq '$parentDN'" -ErrorAction SilentlyContinue)) {
        Write-Warning "父OU $parentDN 不存在，跳过创建OU $($ou.Name)"
        continue
    }
    # 创建OU，关闭意外删除保护方便后续调整
    New-ADOrganizationalUnit -Name $ou.Name -Path $parentDN -Description $ou.Description -StreetAddress $ou.StreetAddress -City $ou.City -State $ou.State -PostalCode $ou.PostalCode -Country $ou.Country -ProtectedFromAccidentalDeletion $false
    Write-Host "已创建OU：$($ou.Name)"
}

Write-Host "OU结构导入完成"

2. 导入AD用户（全属性） #

$users = Import-Csv -Path "$importPath\Users_Export.csv" -Encoding UTF8

foreach ($user in $users) {
    # 排除无法跨域导入的系统属性，可根据实际情况增减
    $userProperties = $user | Select-Object -Property * -ExcludeProperty ObjectGUID, ObjectSID, SamAccountType, ObjectClass, DistinguishedName, Created, Modified, LastLogonDate
    
    # 设置用户所在的目标OU
    $targetOU = $user.DistinguishedName -replace "^CN=$($user.Name),", ""
    # 检查目标OU是否存在
    if (-not (Get-ADOrganizationalUnit -Filter "DistinguishedName -eq '$targetOU'" -ErrorAction SilentlyContinue)) {
        Write-Warning "目标OU $targetOU 不存在，跳过创建用户 $($user.Name)"
        continue
    }
    
    # 创建用户，设置临时初始密码（需符合Test域密码策略）
    $tempPassword = ConvertTo-SecureString "TempPass@2024" -AsPlainText -Force
    New-ADUser -Name $user.Name -SamAccountName $user.SamAccountName -UserPrincipalName $user.UserPrincipalName -Path $targetOU -AccountPassword $tempPassword -Enabled $user.Enabled -OtherAttributes $userProperties
    
    Write-Host "已创建用户：$($user.Name)"
}

Write-Host "用户导入完成，所有用户初始密码为 TempPass@2024，请及时通知用户重置"

3. 导入AD组 #

$groups = Import-Csv -Path "$importPath\Groups_Export.csv" -Encoding UTF8

foreach ($group in $groups) {
    # 设置组所在的目标OU
    $targetOU = $group.DistinguishedName -replace "^CN=$($group.Name),", ""
    # 检查目标OU是否存在
    if (-not (Get-ADOrganizationalUnit -Filter "DistinguishedName -eq '$targetOU'" -ErrorAction SilentlyContinue)) {
        Write-Warning "目标OU $targetOU 不存在，跳过创建组 $($group.Name)"
        continue
    }
    
    # 创建组
    New-ADGroup -Name $group.Name -SamAccountName $group.SamAccountName -GroupCategory $group.GroupCategory -GroupScope $group.GroupScope -Path $targetOU -Description $group.Description
    
    Write-Host "已创建组：$($group.Name)"
}

Write-Host "组导入完成"

4. 导入组成员 #

$groupMembers = Import-Csv -Path "$importPath\GroupMembers_Export.csv" -Encoding UTF8

foreach ($member in $groupMembers) {
    # 将Prod域的DN转换为Test域的DN
    $targetGroupDN = $member.GroupDN -replace "DC=Prod,DC=com", "DC=Test,DC=com"
    $targetMemberDN = $member.MemberDN -replace "DC=Prod,DC=com", "DC=Test,DC=com"
    
    # 检查组和成员是否存在
    $groupExists = Get-ADGroup -Filter "DistinguishedName -eq '$targetGroupDN'" -ErrorAction SilentlyContinue
    $memberExists = Get-ADUser -Filter "DistinguishedName -eq '$targetMemberDN'" -ErrorAction SilentlyContinue
    if (-not $groupExists -or -not $memberExists) {
        Write-Warning "组 $targetGroupDN 或成员 $targetMemberDN 不存在，跳过添加成员"
        continue
    }
    
    # 添加成员到组
    Add-ADGroupMember -Identity $targetGroupDN -Members $targetMemberDN
    
    Write-Host "已将成员 $($member.MemberSamAccountName) 添加到组 $($member.GroupDN -split ',' | Select-Object -First 1 -Replace 'CN=')"
}

Write-Host "组成员导入完成"

额外注意事项 #

• 脚本中的域名称（DC=Prod,DC=com、DC=Test,DC=com）需要根据你的实际域结构修改
• 如果有自定义AD属性，需要在导入用户时确认是否能正常映射，必要时调整属性排除列表
• 执行脚本前建议先在小范围测试环境验证，避免影响正式域环境

内容的提问来源于stack exchange，提问作者vespavbb