题 基于“托管”Active Directory属性的计算机动态分组


公司策略要求每个服务器都分配了管理员。此信息保存在计算机对象的“管理者”字段中。

在SCOM中创建一个通过此AD字段填充的动态组非常有用。这就是我的问题所在。

我试过的步骤很远。

1.为Windows计算机目标创建“管理者”属性。此属性由WMI查询提供 SELECT * FROM DS_computer 与财产 DS_managedBy

2.使用动态过滤器创建一个组。 (Object is Windows-Computer_Extended AND (Managed by Equals usr) AND True)

现在这在理论上似乎是合理的,但显然根本不起作用。

这实际上可能是我想要创建的吗?我如何解决这个问题?


7
2018-01-23 16:40




这听起来像是你将要编写脚本的东西,例如,在Powershell中,然后定期运行该脚本作为计划任务。 - Ryan Ries
@RyanRies嗯,我从来没有想过这个。如果我成功的话,我会看到我能做什么并最终发布一个脚本。 - Fairy


答案:


经过一些研究,我发现有人已经解决了这个问题。有点。我修改了 这个 脚本。摆脱了最后几行并添加了我需要的逻辑。它很乱,但它的作用就像一个魅力。您需要更改的是管理服务器和包含正则表达式(我们有多个域,但只想要一种自动化)。

<Functions from original script go here>

$ManagementServer = "<ManagementServerGoesHere>"

$ManagementGroup = GetSCOMManagementGroup -ms $ManagementServer
$Groups = Get-SCOMGroup -DisplayName "Managed-By *"
$Groups |% {
    $Group = $_
    $Group.DisplayName -match "Managed-By (\w{3})" | Out-Null
    $sAMAccountName = $Matches[1]
    $User = Get-ADUser -Filter {sAMAccountName -eq $sAMAccountName}
    $UserDN = $User.DistinguishedName
    $ADManagedByComputers = Get-ADComputer -Filter {ManagedBy -eq $UserDN}
    $SCOMManagedByComputer = Get-SCOMGroup $Group.id | Get-SCOMClassInstance
    [string]$InstancesToAdd = ""
    [string]$InstancesToRemove = ""

    $ADManagedByComputers | % {
        if($SCOMManagedByComputer.DisplayName -notcontains $_.DNSHostName) {
            $Agent = Get-SCOMAgent -DNSHostName $_.DNSHostName
            if($Agent) {
                Write-Host ($_.DNSHostName + " not in SCOM Group " + $Group.DisplayName) -ForegroundColor Yellow
                $InstancesToAdd = $InstancesToAdd + "," + $Agent.Id
             } else {
                Write-Host ($_.DNSHostName + " has no Agent installed!") -ForegroundColor Gray
             }
        } else {
            Write-Host ($_.DNSHostname + " already in SCOM Group " + $Group.DisplayName) -ForegroundColor Green
        }
    }

    $SCOMManagedByComputer | % {
        if($_.DisplayName -match "<InclusionRegex>") {
            if($ADManagedByComputers.DNSHostName -notcontains $_.DisplayName) {
                Write-Host ($_.DisplayName + " should not be in SCOM Group " + $Group.DisplayName) -ForegroundColor DarkYellow
                $Agent = Get-SCOMAgent -DNSHostName $_.DisplayName
                if($Agent) {
                    $InstancesToRemove = $InstancesToRemove + "," + $Agent.Id
                }
            }  
        } else {
            Write-Host ($_.DisplayName + " is not in the domain scope. Skipping.") -ForegroundColor Cyan
        }
    }

    $InstancesToAdd = $InstancesToAdd.Trim(",")
    $InstancesToRemove = $InstancesToRemove.Trim(",")


        $ManagementPackName = ($Group | Get-SCOMClass).ManagementPackName
        $ManagementPackID = (Get-SCManagementPack -Name $ManagementPackName)
        $MP = ValidateGroup -mg $ManagementGroup -mp $MP -groupID $Group.FullName
    If($InstancesToAdd -ne "" -and $InstancesToRemove -ne "") {
        $MP = UpdateGroup -mg $ManagementGroup -mp $ManagementPackID -groupID $Group.FullName -instancesToAdd $InstancesToAdd -instancesToRemove $InstancesToRemove
    }

    if($InstancesToAdd -ne "" -and $InstancesToRemove -eq "") {
        $MP = UpdateGroup -mg $ManagementGroup -mp $MP -groupID $Group.FullName -instancesToAdd $InstancesToAdd
    }

    if($InstancesToAdd -eq "" -and $InstancesToRemove -ne "") {
        $MP = UpdateGroup -mg $ManagementGroup -mp $MP -groupID $Group.FullName -instancesToRemove $InstancesToRemove
    }
}

2
2018-01-30 15:00