如何编写可交互输入参数的简单Powershell脚本为AD安全组分配用户

现有代码的核心问题 #

• 单引号不解析变量：PowerShell中单引号会原样输出包裹的内容，不会识别其中的变量值。你在给Get-ADGroup、Add-ADGroupMember、Get-ADUser传参时，用单引号包裹了$SecurityGroup、$User变量，实际传给命令的是固定文本，不是输入的真实组名、用户ID，必然会触发找不到AD对象的错误。
• 语法不完整：最后一行Write-Host的输出字符串缺少收尾单引号，脚本运行时会直接报语法错误，无法执行后续逻辑。
• 全角字符报错：Get-ADUser的Identity参数前使用了全角破折号–，PowerShell仅识别半角连字符-，会判定参数不存在。
• 缺少校验逻辑：如果输入的组名、用户ID不存在，或当前账号没有AD操作权限，脚本会抛出晦涩的系统报错，无法快速定位问题。

修正后的可用脚本 #

# 自动加载AD域管理模块
Import-Module ActiveDirectory -ErrorAction SilentlyContinue

# 获取用户输入
$SecurityGroup = Read-Host -Prompt 'Input the SecurityGroup name'
$User = Read-Host -Prompt 'Input the userID'

# 校验目标安全组是否存在
try {
    $targetGroup = Get-ADGroup -Identity $SecurityGroup -ErrorAction Stop
}
catch {
    Write-Host "Error: Can't find AD group named '$SecurityGroup', please check your input" -ForegroundColor Red
    exit
}

# 校验目标用户是否存在
try {
    $targetUser = Get-ADUser -Identity $User -Properties MemberOf -ErrorAction Stop
}
catch {
    Write-Host "Error: Can't find AD user with ID '$User', please check your input" -ForegroundColor Red
    exit
}

# 检查是否已在组内，避免重复加组
if ($targetUser.MemberOf -contains $targetGroup.DistinguishedName) {
    Write-Host "Info: User '$User' is already a member of group '$SecurityGroup', no action needed" -ForegroundColor Yellow
    exit
}

# 执行加组操作
try {
    Add-ADGroupMember -Identity $SecurityGroup -Members $User -ErrorAction Stop
}
catch {
    Write-Host "Failed to add user to group: $($_.Exception.Message)" -ForegroundColor Red
    exit
}

# 输出成功提示
Write-Host "Success: User with ID '$User' has been added to security group '$SecurityGroup'" -ForegroundColor Green
Write-Host "`nCurrent AD groups this user belongs to:"
$targetUser.MemberOf | ForEach-Object {
    (Get-ADGroup -Identity $_).Name
}

使用注意事项 #

• 运行脚本的设备需要提前安装RSAT域管理工具，确保ActiveDirectory模块可正常加载。
• 运行脚本的账号需要拥有目标AD安全组的成员修改权限，否则加组操作会被域控拒绝。
• 脚本会自动跳过重复加组的操作，不会因为用户已在组内直接报错。

内容的提问来源于stack exchange，提问作者DarrellE