PowerShell动态参数自动补全随参数位置失效问题排查

问题重现 #

用户编写了如下PowerShell函数（适用于PowerShell 5.1及7.5.2）：

function New-User
{
    [CmdletBinding()]
    Param(
        [Parameter(Mandatory=$true)]
        [ValidatePattern("^[a-z0-9 ]+$")]
        [string]$Name,
        [Parameter(Mandatory=$true)]
        [ValidateScript({ Get-ADOrganizationalUnit -Identity $_ })]
        [string]$Path,
        [ValidatePattern("^[a-z0-9 ]+$")]
        [string]$SamAccountName = $Name,
        [ArgumentCompleter(
            {
                param($Command, $Parameter, $WordToComplete, $CommandAst, $FakeBoundParams)

                [array]$validValues = (Get-ADUser -Filter "department -like '*'" -Properties department | Sort-Object -Property department -Unique).department
                $validValues -like "$WordToComplete*"
            }
        )]
        [ValidateScript(
            {
                $_ -in (Get-ADUser -Filter "department -like '*'" -Properties department | Sort-Object -Property department -Unique).department
            }
        )]
        [string]$Department
    )
    DynamicParam
    {
        if ($Department)
        {
            $paramDictionary = New-Object -Type System.Management.Automation.RuntimeDefinedParameterDictionary
            $paramAttributesCollection = New-Object -Type System.Collections.ObjectModel.Collection[System.Attribute]
            $paramAttributes = New-Object -Type System.Management.Automation.ParameterAttribute
            $paramAttributes.Mandatory = $false
            $paramAttributesCollection.Add($paramAttributes)
            # Direct Dynamic ValidateSet
            $paramAttributesCollection.Add((New-Object -Type System.Management.Automation.ValidateSetAttribute((Get-ADUser -Filter "department -eq '$Department' -and title -like '*'" -Properties title | Sort-Object -Property title -Unique).title)))
            $dynParam1 = New-Object -Type System.Management.Automation.RuntimeDefinedParameter("Title", [string], $paramAttributesCollection)
            $paramDictionary.Add("Title", $dynParam1)
            return $paramDictionary
        }
    }
    Begin
    {
        $Title = $PSBoundParameters['Title']
    }
    Process
    {
        $SamAccountName
        $Department
        $Title
    }
}

问题现象 #

• 执行New-User -Name Doe -Department IT时，能正常自动补全动态参数-Title及其可选值；
• 但先指定-Path参数（如New-User -Name Doe -Path "OU=Tests,DC=mydom,DC=adds" -Department IT）时，按-+Ctrl+Space无法显示-Title参数，手动输入后验证功能正常；
• 移除-Path的[ValidateScript]验证后，动态参数补全恢复正常，改用[ADSI]验证仍无效；
• PowerShell 7.5.2中存在相同问题。

问题原因 #

PowerShell生成参数补全候选列表时，会提前执行静态参数的验证脚本（包括[ValidateScript]）。当-Path参数带有查询AD的验证逻辑时，会干扰动态参数的检测流程：

1. 补全触发时，PowerShell先尝试绑定已输入的参数，执行-Path的ValidateScript（调用Get-ADOrganizationalUnit）；
2. 这个AD查询操作会导致参数绑定上下文异常，使得后续无法正确识别$Department已被指定，进而无法生成-Title动态参数。

修复方案 #

方案1：静态补全+运行时验证 #

把-Path的验证逻辑从静态ValidateScript移到函数内部的运行时检查，同时保留参数自动补全功能：

function New-User
{
    [CmdletBinding()]
    Param(
        [Parameter(Mandatory=$true)]
        [ValidatePattern("^[a-z0-9 ]+$")]
        [string]$Name,
        [Parameter(Mandatory=$true)]
        [ArgumentCompleter({
            param($Command, $Parameter, $WordToComplete, $CommandAst, $FakeBoundParams)
            # 提供OU的自动补全
            (Get-ADOrganizationalUnit -Filter * | Select-Object -ExpandProperty DistinguishedName) -like "$WordToComplete*"
        })]
        [string]$Path,
        [ValidatePattern("^[a-z0-9 ]+$")]
        [string]$SamAccountName = $Name,
        [ArgumentCompleter(
            {
                param($Command, $Parameter, $WordToComplete, $CommandAst, $FakeBoundParams)
                [array]$validValues = (Get-ADUser -Filter "department -like '*'" -Properties department | Sort-Object -Property department -Unique).department
                $validValues -like "$WordToComplete*"
            }
        )]
        [ValidateScript(
            {
                $_ -in (Get-ADUser -Filter "department -like '*'" -Properties department | Sort-Object -Property department -Unique).department
            }
        )]
        [string]$Department
    )
    DynamicParam
    {
        if ($Department)
        {
            $paramDictionary = New-Object -Type System.Management.Automation.RuntimeDefinedParameterDictionary
            $paramAttributesCollection = New-Object -Type System.Collections.ObjectModel.Collection[System.Attribute]
            $paramAttributes = New-Object -Type System.Management.Automation.ParameterAttribute
            $paramAttributes.Mandatory = $false
            $paramAttributesCollection.Add($paramAttributes)
            $paramAttributesCollection.Add((New-Object -Type System.Management.Automation.ValidateSetAttribute((Get-ADUser -Filter "department -eq '$Department' -and title -like '*'" -Properties title | Sort-Object -Property title -Unique).title)))
            $dynParam1 = New-Object -Type System.Management.Automation.RuntimeDefinedParameter("Title", [string], $paramAttributesCollection)
            $paramDictionary.Add("Title", $dynParam1)
            return $paramDictionary
        }
    }
    Begin
    {
        $Title = $PSBoundParameters['Title']
        # 运行时验证Path是否为有效OU
        if (-not (Get-ADOrganizationalUnit -Identity $Path -ErrorAction SilentlyContinue)) {
            throw "指定的Path不是有效的组织单元：$Path"
        }
    }
    Process
    {
        $SamAccountName
        $Department
        $Title
    }
}

方案2：格式预验证+运行时完整验证 #

如果需要保留部分静态验证，可先通过正则匹配LDAP路径格式，再在运行时检查OU是否存在：

# 修改Path参数定义
[Parameter(Mandatory=$true)]
[ValidatePattern("^OU=.*,DC=.*$")] # 简单匹配OU路径格式
[string]$Path,

# 在Begin块添加完整验证
Begin
{
    $Title = $PSBoundParameters['Title']
    if (-not (Get-ADOrganizationalUnit -Identity $Path -ErrorAction SilentlyContinue)) {
        throw "指定的Path不是有效的组织单元：$Path"
    }
}

验证效果 #

修改后，无论-Path参数在命令中的位置如何，只要指定了有效的-Department，按-+Ctrl+Space都能正常显示-Title参数并提供对应的自动补全值。

内容的提问来源于stack exchange，提问作者CFou