批量添加AD组到组时触发ParameterBindingException问题求助

问题代码 #

$MissingGroup = 'GGroup01'

$getADGroupSplat = @{
    # find all groups where `$MissingGroup` is NOT a member of
    LDAPFilter = '(!memberof={0})' -f (Get-ADGroup $MissingGroup).DistinguishedName
    SearchBase = 'OU=xxxxxxxxxxx,DC=xxxxxxxxxxxxx,DC=xx'
}

$Group = Get-ADGroup @getADGroupSplat

$actualGroup = $Group | Where-Object {$_.Name -like "GGroup_A0*_Security"} | Format-List Name

Add-ADGroupMember -Identity $MissingGroup -Members $actualGroup

错误信息（翻译后） #

Add-ADGroupMember：无法绑定参数“Members”。无法创建类型为“Microsoft.ActiveDirectory.Management.ADPrincipal”的对象，适配器无法设置Name属性的值。
在第1行第61字符:

• ... -ADGroup -Identit $CitrixGG | Add-ADGroupMember -Members $actualGroup

• ~~~~~~~~~~~~
  

  • CategoryInfo : InvalidArgument: (:) [Add-ADGroupMember], ParameterBindingException
  • FullyQualifiedErrorId : CannotConvertArgumentNoMessage,Microsoft.ActiveDirectory.Management.Commands.AddADGroupMember

解决方法 #

错误原因 #

Format-List Name命令会把原始的AD组对象转换为格式化输出对象（类型为Microsoft.PowerShell.Commands.Internal.Format），而Add-ADGroupMember的-Members参数需要接收ADPrincipal类型对象（如AD组本身）或合法的标识符字符串（名称、DN、SID等），两者类型不匹配导致参数绑定失败。

修正代码 #

可选择以下两种方式之一：

方式1：保留原始AD组对象直接传递

去掉Format-List Name，直接传递筛选后的AD组对象：

$MissingGroup = 'GGroup01'

$getADGroupSplat = @{
    LDAPFilter = '(!memberof={0})' -f (Get-ADGroup $MissingGroup).DistinguishedName
    SearchBase = 'OU=xxxxxxxxxxx,DC=xxxxxxxxxxxxx,DC=xx'
}

$Group = Get-ADGroup @getADGroupSplat

$actualGroup = $Group | Where-Object {$_.Name -like "GGroup_A0*_Security"}

Add-ADGroupMember -Identity $MissingGroup -Members $actualGroup

方式2：提取组名称字符串传递

如果需要仅传递组名称，使用Select-Object -ExpandProperty Name提取纯名称字符串：

$MissingGroup = 'GGroup01'

$getADGroupSplat = @{
    LDAPFilter = '(!memberof={0})' -f (Get-ADGroup $MissingGroup).DistinguishedName
    SearchBase = 'OU=xxxxxxxxxxx,DC=xxxxxxxxxxxxx,DC=xx'
}

$Group = Get-ADGroup @getADGroupSplat

$actualGroup = $Group | Where-Object {$_.Name -like "GGroup_A0*_Security"} | Select-Object -ExpandProperty Name

Add-ADGroupMember -Identity $MissingGroup -Members $actualGroup

内容的提问来源于stack exchange，提问作者cosmo_