powershell:Set ADUser:请求的操作未满足与对象类关联的一个或多个约束

为了测试另一个脚本，我创建了一个快速而肮脏的Powershellscript，以便能够在2个不同域的多个OU中创建和删除大量用户帐户

虽然创建工作没有问题，但当设置$num的值高于1000时，我无法通过Set AdUser用一些属性填充帐户。但是：如果我从1或100开始，脚本工作正常

使用1000+时，我总是会发现以下错误：

Set-ADUser : The requested operation did not satisfy one or more constraints associated with the class of the object
At C:\Users\Administrator.TEST\Desktop\ps\createSomeUsers.ps1:117 char:9
+         Set-ADUser -Identity $num -replace $hash -Server $dc2 -Credential $W ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (10000000:ADUser) [Set-ADUser], ADInvalidOperationException
    + FullyQualifiedErrorId : ActiveDirectoryServer:8212,Microsoft.ActiveDirectory.Management.Commands.SetADUser

这是从哪里来的？这是我剧本中的问题吗？如果我手动使用set AdUser，其值为10000000，那么它似乎可以正常工作

出于测试目的，我必须使用8位数字

事情是这样的：

$dc1 = "192.168.3.99" # DC1
$dc2 = "192.168.2.99"  # DC2

# OUs in where to create the accounts
$ou1_1 = "OU=Users,OU=mop,OU=e01,OU=DE,OU=EMEA,DC=relf,DC=com"
$ou2_1 = "OU=Users,OU=loh,OU=e03,OU=DE,OU=EMEA,DC=relf,DC=com"
$ou3_1 = "OU=Users,OU=fer,OU=e05,OU=DE,OU=EMEA,DC=relf,DC=com"

$ou1_2 = "OU=Users,OU=mop,OU=e01,OU=DE,OU=EMEA,DC=TEST,DC=com"
$ou2_2 = "OU=Users,OU=loh,OU=e03,OU=DE,OU=EMEA,DC=TEST,DC=com"
$ou3_2 = "OU=Users,OU=fer,OU=e05,OU=DE,OU=EMEA,DC=TEST,DC=com"

# number of users in OUs
$ou1_amount = 1
$ou2_amount = 1
$ou3_amount = 1

# numeration
$num = 10000000

# total Nr. of accounts
$acc_total = $ou1_amount + $ou2_amount + $ou3_amount

# path and filename 4 .logfiles
$invocation = (Get-Variable MyInvocation).Value
$curdir = Split-Path $invocation.MyCommand.Path
# check if logfile folder is not created yet, if not: create
$tp = $curdir + "\logfiles\"
if (!(Test-Path -Path $tp)) {
new-item $tp -itemtype directory
}
$logfilepath = $tp

# Username and PW for dc1 and dc2:
$creds1 = "relf\PS-User"
$creds2 = "TEST\PS-User"
$pass1 = gc $curdir"\securestring1.txt" | convertto-securestring 
$pass2 = gc $curdir"\securestring2.txt" | convertto-securestring 
$WPS_AdminCredentials1 = new-object -typename System.Management.Automation.PSCredential -argumentlist $creds1,$pass1    
$WPS_AdminCredentials2 = new-object -typename System.Management.Automation.PSCredential -argumentlist $creds2,$pass2   

# Attributes
$attributes = "c","co","company","countryCode","department","Description","displayName",
                "givenName","mail","physicalDeliveryOfficeName","postalAddress",
                "postalCode","sAMAccountName","sn","st","streetAddress",
                "telephoneNumber","title","wWWHomePage","l","postOfficeBox"

# The ultimate question
$d_O_c = Read-Host '[D]elete OR [C]reate?'

if ($d_O_c -eq "c") {
    write-host "OU1"
    while ($ou1_amount -gt 0) {
        New-ADUser -Name $num -Path $ou1_1 -SamAccountName $num -DisplayName $num -Server $dc1 -Credential $WPS_AdminCredentials1 `
        -AccountPassword (ConvertTo-SecureString "pw1234" -AsPlainText -Force) -ChangePasswordAtLogon $true -Enabled $true

        New-ADUser -Name $num -Path $ou1_2 -SamAccountName $num -DisplayName $num -Server $dc2 -Credential $WPS_AdminCredentials2 `
        -AccountPassword (ConvertTo-SecureString "pw1234" -AsPlainText -Force) -ChangePasswordAtLogon $true -Enabled $true

        write-host $num "of" $acc_total "created"
        $ou1_amount--
        $num++
        }

    write-host "OU2"
    while ($ou2_amount -gt 0) {
        New-ADUser -Name $num -Path $ou2_1 -SamAccountName $num -DisplayName $num -Server $dc1 -Credential $WPS_AdminCredentials1 `
        -AccountPassword (ConvertTo-SecureString "pw1234" -AsPlainText -Force) -ChangePasswordAtLogon $true -Enabled $true

        New-ADUser -Name $num -Path $ou2_2 -SamAccountName $num -DisplayName $num -Server $dc2 -Credential $WPS_AdminCredentials2 `
        -AccountPassword (ConvertTo-SecureString "pw1234" -AsPlainText -Force) -ChangePasswordAtLogon $true -Enabled $true

        write-host $num "of" $acc_total "created"
        $ou2_amount--
        $num++
        }

    write-host "OU3"
    while ($ou3_amount -gt 0) {
        New-ADUser -Name $num -Path $ou3_1 -SamAccountName $num -DisplayName $num -Server $dc1 -Credential $WPS_AdminCredentials1 `
        -AccountPassword (ConvertTo-SecureString "pw1234" -AsPlainText -Force) -ChangePasswordAtLogon $true -Enabled $true

        New-ADUser -Name $num -Path $ou3_2 -SamAccountName $num -DisplayName $num -Server $dc2 -Credential $WPS_AdminCredentials2 `
        -AccountPassword (ConvertTo-SecureString "pw1234" -AsPlainText -Force) -ChangePasswordAtLogon $true -Enabled $true

        write-host $num "of" $acc_total "created"
        $ou3_amount--
        $num++
        }
`
    $num--
    while ($num -ge 10000000) {
        $hash = @{}
        $attributes | % {
            $hash[$_] = $num
        }
        Set-ADUser -Identity $num -replace $hash -Server $dc2 -Credential $WPS_AdminCredentials2
        write-host $num "edited"
        $num--
    }
}
elseif ($d_O_c -eq "d") {
    $latest = 10000000 + $acc_total
    $latest--
    while ($latest -ge 10000000) {
    Remove-ADUser -Identity $latest -Confirm:$false -Server $dc1 -Credential $WPS_AdminCredentials1
    Remove-ADUser -Identity $latest -Confirm:$false -Server $dc2 -Credential $WPS_AdminCredentials2
    write-host $latest "deleted"
    $latest--
    }
}

编辑：正如Matt在评论中提到的，错误消息只是与广告中某些属性的某些限制有关。 我现在为所有属性使用另一个较短的值。

---

谢谢你的帮助

我找不到我想添加到此文件中的正式文档，但似乎您正试图根据收到的错误为AD对象属性分配无效值：

请求的操作不满足与对象类关联的一个或多个约束

看看您的示例，它似乎来自这段代码

while ($num -ge 10000000) {
    $hash = @{}
    $attributes | % {
        $hash[$_] = $num
    }
    Set-ADUser -Identity $num -replace $hash -Server $dc2 -Credential $WPS_AdminCredentials2
    write-host $num "edited"
    $num--
}

您正在使用广告属性构建$hash，并根据我所看到的将它们全部赋值为10000000。我知道有些房产不允许这样做。不确定您是否正在创建测试/虚拟帐户，但您不能简单地创建一组所有可设置属性都是相同数字的用户

旁注

我们在评论中谈到了错误行号和代码匹配。在本例中，很容易找到错误的来源，但下次请尝试并尽可能清楚地了解错误以及错误发生的位置

---

如果您对此仍有问题，请更新您的问题，或者如果与此问题太不同，请提出新问题

您确定要使用号码作为标识吗？它调用ADUser类型的对象。对我来说，过滤Get ADUser查询并将其传递到Foreach对象集ADUser-Identity$\。。。类型语句。有关参数的详细信息，请参见此处：我是否遗漏了什么？首先，显示错误的代码中没有117行。另外，将所有属性设置为10000000（循环$attributes |%{$hash[$\u]=$num}的作用是什么？将所有这些属性设置为数值将是一个问题。其中一些最有可能不允许使用一个或多个那么长的数字。。。。必须查找模式才能确定。那是我对你的错误来源的猜测是的，谢谢。确实是高数字导致了某些属性中的错误，因为它们似乎仅限于X个字母/数字。至于缺少的行：我总是有一个较大的“标题”和许多我通常排除的评论。我应该提到这一点。很抱歉