使用“0”参数调用“FindAll”异常 - 可信域 LDAP 搜索

Question

我的方法是ModifyTimeStamp在扫描所有 DC 后获取最新的。我的代码中的场景是：

首先，我扫描 PDC 以获取distinguishedName值，然后扫描所有 DC 以获取distinguishedName值，如果它们-eq彼此相关，它将打印 ，ModifyTimeStamp这意味着ModifyTimeStamp每个 DC 上的所有值都将存储在数组列表中。arraylist 将打印最大值。如下：

$TrustedDomain = "test.com"
$context = new-object System.DirectoryServices.ActiveDirectory.DirectoryContext("domain",$TrustedDomain)
$D = [System.DirectoryServices.ActiveDirectory.Domain]::GetDomain($context)
$PDC = $D.PdcRoleOwner 
$ADSearch = New-Object System.DirectoryServices.DirectorySearcher 
$ADSearch.SearchRoot ="LDAP://$PDC"
$ADSearch.SearchScope = "subtree"
$ADSearch.PageSize = 100
$ADSearch.Filter = "(&(objectCategory=person)(objectClass=user))"
foreach($pro in $properies)
{
    $ADSearch.PropertiesToLoad.add($pro)| out-null
}
$userObjects = $ADSearch.FindAll()

$dnarr = New-Object System.Collections.ArrayList
Function modiScan{
    $Searcher = New-Object System.DirectoryServices.DirectorySearcher 
    $Searcher.PageSize = 100 
    $Searcher.SearchScope = "subtree" 
    $Searcher.Filter = "(&(objectCategory=person)(objectClass=user))"
    $Searcher.PropertiesToLoad.Add("distinguishedName")|Out-Null
    $Searcher.PropertiesToLoad.Add("modifyTimeStamp")|Out-Null
    forEach ($users In $userObjects) 
    { 

            $DN = $users.Properties.Item("distinguishedName")[0]
            $dnarr.add($DN)|Out-Null
    }
    #$dnarr
    foreach($dnn in $dnarr){
                $lastmd = New-Object System.Collections.ArrayList
                ForEach ($DC In $D.DomainControllers){

                    $Server = $DC.Name
                    $Base = "LDAP://$Server/"+$dnn
                    $Searcher.SearchRoot = $Base 
                    $Results2 = $Searcher.FindAll()
                    ForEach ($Result2 In $Results2) 
                    {                          
                        $DN2 = $Result2.Properties.Item("distinguishedName")[0]
                        if($DN2 -eq $dnn){
                            $modi = $Result2.Properties.Item("modifyTimeStamp")[0]
                            $lastmd.Add($modi)|Out-Null
                        } 
                    } 
                }
      $lastModi = ($lastmd |measure -max).maximum      
      if($lastModi -ne $null){   
            $lastModi = $lastModi.ToString("yyyy/MM/dd")               
        }
        else{
            $lastModi = "N/A"
        }


        $lastModi
   }
}
modiScan

我得到的错误是：

Exception calling "FindAll" with "0" argument(s): "Unknown error (0x80005000)"
At C:\Users\Ender\trustedScan.ps1:40 char:21
+                     $Results2 = $Searcher.FindAll()
+                     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : COMException

我已经在当前域上执行它就像一个魅力。但是当我尝试放置受信任的域时，它会抛出该错误。

Answer 1

尝试设置directoryEntry对象的AuthenticationType属性：

$dirEntry = [System.DirectoryServices.DirectoryEntry]::new("LDAP://$PDC")
$dirEntry.AuthenticationType = [System.DirectoryServices.AuthenticationTypes]::SecureSocketsLayer + [System.DirectoryServices.AuthenticationTypes]::Secure

$ADSearch.SearchRoot = $dirEntry

在这种情况下，您可以连接到 LDAPS（LDAP over SSL）。因此，如果您的服务器配置为拒绝不安全的 LDAP 请求，它可以以安全的方式请求