Powershell替代SetSPN

Question

如何让SetSPN使用DC的特定DC或IP地址？从不属于Lab域的跳转框设置Lab DC内的Lab帐户的服务主体名称.

通过添加"-Server"参数完成大多数Powershell AD cmdlet.

使用SetSPN似乎不可能.

Answer 1

知识分享:

我在最后一天花了很多时间试图找到让SetSPN为我工作的方法,当我试图从一个Jump-box运行到一个带有DC克隆的网络隔离的实验室环境时.

我的其余代码中的所有AD /网络调用都可以指定要与之通信的服务器(PowerShell广告调用通常允许"-Server 192.168.2.1"指定实验室中的DC).

但不是SetSPN.那么对于那些与SetSPN有类似问题的人; 或者只是想独家使用powershell,这是一个使用Powershell的ActiveDirectory模块添加SPN的简单方法.

Function Add-SPN([string]$SamAccountName,[string]$SPNString, [string]$ADServerName){
    Try{
    $filter = "(SamAccountName -eq '$SamAccountName')";
    $user=get-aduser -Filter $Filter -prop ServicePrincipalNames -Server $ADServerName;
    $Ready=$True;
    if($User.ServicePrincipalNames.Count -gt 0){
        if($User.ServicePrincipalNames.ToUpper().Contains($SPNString.ToUpper())){"Failed. A Matching SPNString Already Exists! ($SPNString) -> ($SamAccountName)";$Ready=$false;}
    }
    if($ready){
        $user|Set-ADUser -ServicePrincipalNames @{Add=$SPNString} -Server $ADServerName;
        if((get-aduser -Filter $Filter -prop ServicePrincipalNames -Server $ADServerName).ServicePrincipalNames.ToUpper().Contains($SPNString.ToUpper())){
            "Successfully Added SPN ($spnstring) -> ($SamAccountName)."
        }else{ throw "Something went wrong, SPNString not found after Set-ADUser succeeded."}
    }
    }catch{throw "Add-SPN: SamAccountName($($SamAccountName)) SPNString($($SPNString))An Error Occurred. $_"}
}

Add-SPN -SamAccountName "SVC_Test_SQL" -SPNString "http/$($WebServer.DNSName)" -ADServerName (get-addomain -Identity $ServerDomain).pdcEmulator
Add-SPN -SamAccountName "SVC_Test_SQL" -SPNString "http/$($WebServer.name)" -ADServerName (get-addomain -Identity $ServerDomain).pdcEmulator

实际设置值Set-ADUser(来自:import-module ActiveDircetory)的函数部分可以很容易地修改为删除,替换或清除SPN以获得新功能或扩展上述功能.

From: http://technet.microsoft.com/en-us/library/ee617215.aspx
To add values:
    -ServicePrincipalNames @{Add=value1,value2,...}
To remove values:
    -ServicePrincipalNames @{Remove=value3,value4,...}
To replace values:
    -ServicePrincipalNames @{Replace=value1,value2,...}
To clear all values:
    -ServicePrincipalNames $null