Home / server / Questions / 399482
Accepted
tacos_tacos_tacos
Asked: 2012-06-17 15:51:53 +0800 CST

Querying Active Directory in PowerShell from a Windows host that is not a member of the domain

  • 772

How can I use PowerShell [adsisearcher] to query a domain that I am not a member of? Usually I will do something like this:

$myAdsi = [adsisearcher]""
$myAdsi.SearchRoot = [adsi]"LDAP://dc=corp,dc=mycompany,dc=com"
$myAdsi.Filter = "objectCategory=computer"

$res = $myAdsi.FindAll()

If I run this snippet on a host in my domain, I get the expected result. However, if I run this from a computer that has network access to the domain (through a L2L VPN) I get the error:

Exception calling "FindAll" with "0" argument(s): "The specified domain either does not exist or could not be contacted.
"
At line:11 char:33
+ $adComputers = $searcher.FindAll <<<< ()
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : DotNetMethodException

This is somewhat expected as I have not provided any sort of credentials to [adsisearcher] that would tell it how to authenticate. My question is: how do I let [adsisearcher] know that I want to authenticate against a domain in which I am not a member?

windows-server-2008 powershell active-directory

1 Answers

  1. Best Answer

    Edited out my last reply. Sorry it took me a while to get back to you. The following is shamelessly copied from http://powershell.com/cs/blogs/ebookv2/archive/2012/03/26/chapter-19-user-management.aspx :

    [ADSI] is a shortcut to the DirectoryServices.DirectoryEntry .NET type. That’s why you could have set up the previous connection this way as well:

    $domain = [DirectoryServices.DirectoryEntry]""
$domain
distinguishedName
-----------------
{DC=scriptinternals,DC=technet}

    So try this to provide credentials to another domain:

    $domain = new-object DirectoryServices.DirectoryEntry("LDAP://10.10.10.1","domain\user", "secret")
$domain.name
scriptinternals
$domain.distinguishedName
DC=scriptinternals,DC=technet

    You are right, it's an authentication problem, even though I wish the error message was more accurate to reflect that. This should help you.

    • 4