☰

基於「管理者」Active Directory 屬性對電腦進行動態分組

tag-icon • tag-icon active-directory scom
基於「管理者」Active Directory 屬性對電腦進行動態分組

公司政策要求每台伺服器都分配一名管理員。此資訊保存在電腦物件的「管理者」欄位中。

在 SCOM 中建立動態群組非常有用，該群組透過此 AD 欄位進行填充。這就是我的問題。

我已經嘗試過的步驟。

1. 為 Windows 電腦目標建立屬性「管理者」。此屬性由SELECT * FROM DS_computer具有 property 的WMI 查詢使用DS_managedBy。

2.建立一個帶有動態過濾器的群組。(Object is Windows-Computer_Extended AND (Managed by Equals usr) AND True)

現在這在理論上似乎合理，但顯然根本行不通。

這真的可能是我想要創建的嗎？我該如何解決這個問題？

答案1

經過一番研究，我發現有人已經解決了這個問題。有點。我修改了這腳本。刪除了最後幾行並添加了我需要的下面的邏輯。它很混亂，但它的作用就像一個魅力。您需要更改的只是管理伺服器和包含正規表示式（我們有多個網域，但只希望其中一個網域實現這種自動化）。

<Functions from original script go here>

$ManagementServer = "<ManagementServerGoesHere>"

$ManagementGroup = GetSCOMManagementGroup -ms $ManagementServer
$Groups = Get-SCOMGroup -DisplayName "Managed-By *"
$Groups |% {
    $Group = $_
    $Group.DisplayName -match "Managed-By (\w{3})" | Out-Null
    $sAMAccountName = $Matches[1]
    $User = Get-ADUser -Filter {sAMAccountName -eq $sAMAccountName}
    $UserDN = $User.DistinguishedName
    $ADManagedByComputers = Get-ADComputer -Filter {ManagedBy -eq $UserDN}
    $SCOMManagedByComputer = Get-SCOMGroup $Group.id | Get-SCOMClassInstance
    [string]$InstancesToAdd = ""
    [string]$InstancesToRemove = ""

    $ADManagedByComputers | % {
        if($SCOMManagedByComputer.DisplayName -notcontains $_.DNSHostName) {
            $Agent = Get-SCOMAgent -DNSHostName $_.DNSHostName
            if($Agent) {
                Write-Host ($_.DNSHostName + " not in SCOM Group " + $Group.DisplayName) -ForegroundColor Yellow
                $InstancesToAdd = $InstancesToAdd + "," + $Agent.Id
             } else {
                Write-Host ($_.DNSHostName + " has no Agent installed!") -ForegroundColor Gray
             }
        } else {
            Write-Host ($_.DNSHostname + " already in SCOM Group " + $Group.DisplayName) -ForegroundColor Green
        }
    }

    $SCOMManagedByComputer | % {
        if($_.DisplayName -match "<InclusionRegex>") {
            if($ADManagedByComputers.DNSHostName -notcontains $_.DisplayName) {
                Write-Host ($_.DisplayName + " should not be in SCOM Group " + $Group.DisplayName) -ForegroundColor DarkYellow
                $Agent = Get-SCOMAgent -DNSHostName $_.DisplayName
                if($Agent) {
                    $InstancesToRemove = $InstancesToRemove + "," + $Agent.Id
                }
            }  
        } else {
            Write-Host ($_.DisplayName + " is not in the domain scope. Skipping.") -ForegroundColor Cyan
        }
    }

    $InstancesToAdd = $InstancesToAdd.Trim(",")
    $InstancesToRemove = $InstancesToRemove.Trim(",")


        $ManagementPackName = ($Group | Get-SCOMClass).ManagementPackName
        $ManagementPackID = (Get-SCManagementPack -Name $ManagementPackName)
        $MP = ValidateGroup -mg $ManagementGroup -mp $MP -groupID $Group.FullName
    If($InstancesToAdd -ne "" -and $InstancesToRemove -ne "") {
        $MP = UpdateGroup -mg $ManagementGroup -mp $ManagementPackID -groupID $Group.FullName -instancesToAdd $InstancesToAdd -instancesToRemove $InstancesToRemove
    }

    if($InstancesToAdd -ne "" -and $InstancesToRemove -eq "") {
        $MP = UpdateGroup -mg $ManagementGroup -mp $MP -groupID $Group.FullName -instancesToAdd $InstancesToAdd
    }

    if($InstancesToAdd -eq "" -and $InstancesToRemove -ne "") {
        $MP = UpdateGroup -mg $ManagementGroup -mp $MP -groupID $Group.FullName -instancesToRemove $InstancesToRemove
    }
}

相關內容