主页 / server / 问题 / 1079672
Accepted
daisy
Asked: 2021-10-06 16:59:36 +0800 CST

立即刷新 SDProp 的脚本？

  • 772

我正在阅读此文档，如何在 Windows 2016 域控制器上立即刷新 sdprop？

我正在尝试在命令行中执行此操作，但上面文档中引用的链接非常模糊，我无法理解。

有人知道吗？

active-directory

1 个回答

  1. Best Answer

    由于可能会运行其他命令，因此这可能会有些通用。例如，常用的 removeLingeringObject。

    来源：https ://github.com/edemiilliere/ADSI/blob/master/Invoke-ADSDPropagation.ps1

    Function Invoke-ADSDPropagation{
<#
.SYNOPSIS
    Invoke a SDProp task on the PDCe.
.DESCRIPTION
    Make an LDAP call to trigger SDProp.
.EXAMPLE
    Invoke-ADSDPropagation
    By default, RunProtectAdminGroupsTask is used.
.EXAMPLE
    Invoke-ADSDPropagation -TaskName FixUpInheritance
    Use the legacy FixUpInheritance task name for Windows Server 2003 and earlier.
.PARAMETER TaskName
    Name of the task to use.
        - FixUpInheritance for legacy OS
        - RunProtectAdminGroupsTask for recent OS
.INPUTS
.OUTPUTS
.NOTES
    You can track progress with:
    Get-Counter -Counter '\directoryservices(ntds)\ds security descriptor propagator runtime queue' | Select-Object -ExpandProperty CounterSamples | Select-Object -ExpandProperty CookedValue
.LINK
    http://ItForDummies.net
#>
[CmdletBinding()]
Param(
    [Parameter(Mandatory=$false,
        HelpMessage='Name of the domain where to force SDProp to run',
        Position=0)]
    [ValidateScript({Test-Connection -ComputerName $_ -Count 2 -Quiet})]
    [String]$DomainName = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain().Name,

    [ValidateSet('RunProtectAdminGroupsTask','FixUpInheritance')]
    [String]$TaskName = 'RunProtectAdminGroupsTask'
)

try{
$DomainContext = New-Object System.DirectoryServices.ActiveDirectory.DirectoryContext('domain',$DomainName)
    $DomainObject = [System.DirectoryServices.ActiveDirectory.Domain]::GetDomain($DomainContext)
    
    Write-Verbose -Message "Detected PDCe is $($DomainObject.PdcRoleOwner.Name)."
    $RootDSE = New-Object System.DirectoryServices.DirectoryEntry("LDAP://$($DomainObject.PdcRoleOwner.Name)/RootDSE") 
    $RootDSE.UsePropertyCache = $false 
    $RootDSE.Put($TaskName, "1") # RunProtectAdminGroupsTask & fixupinheritance
    $RootDSE.SetInfo()
}
catch{
    throw "Can't invoke SDProp on $($DomainObject.PdcRoleOwner.Name) !"
}

    }

    • 1

相关问题