powerView--Get-NetDomain

获取域的有关信息

filter Get-NetDomain {
<#
    .SYNOPSIS
        Returns a given domain object.
    .PARAMETER Domain
        The domain name to query for, defaults to the current domain.
    .PARAMETER Credential
        A [Management.Automation.PSCredential] object of alternate credentials
        for connection to the target domain.
    .EXAMPLE
        PS C:\> Get-NetDomain -Domain testlab.local
    .EXAMPLE
        PS C:\> "testlab.local" | Get-NetDomain
    .LINK
        http://social.technet.microsoft.com/Forums/scriptcenter/en-US/0c5b3f83-e528-4d49-92a4-dee31f4b481c/finding-the-dn-of-the-the-domain-without-admodule-in-powershell?forum=ITCG
#>

    param(
        [Parameter(ValueFromPipeline=$True)]
        [String]
        $Domain,

        [Management.Automation.PSCredential]
        $Credential
    )

    if($Credential) {
        
        Write-Verbose "Using alternate credentials for Get-NetDomain"

        if(!$Domain) {
            # if no domain is supplied, extract the logon domain from the PSCredential passed
            $Domain = $Credential.GetNetworkCredential().Domain
            Write-Verbose "Extracted domain '$Domain' from -Credential"
        }
   
        $DomainContext = New-Object System.DirectoryServices.ActiveDirectory.DirectoryContext('Domain', $Domain, $Credential.UserName, $Credential.GetNetworkCredential().Password)
        
        try {
            [System.DirectoryServices.ActiveDirectory.Domain]::GetDomain($DomainContext)
        }
        catch {
            Write-Verbose "The specified domain does '$Domain' not exist, could not be contacted, there isn't an existing trust, or the specified credentials are invalid."
            $Null
        }
    }
    elseif($Domain) {
        $DomainContext = New-Object System.DirectoryServices.ActiveDirectory.DirectoryContext('Domain', $Domain)
        try {
            [System.DirectoryServices.ActiveDirectory.Domain]::GetDomain($DomainContext)
        }
        catch {
            Write-Verbose "The specified domain '$Domain' does not exist, could not be contacted, or there isn't an existing trust."
            $Null
        }
    }
    else {
        [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
    }
}

1、如果我们有传入Credential，并且没有传入Domain那么就直接从Credential当中获取

$Credential.GetNetworkCredential().Domain

使用 Get-Credential 生成的凭据对象

获取了凭据之后，再去通过这个凭据对象查看域的内容就可以查看到了

2、如果传入了Credential和Domain也存在的话，那么通过初始化指定类型的 DirectoryContext 类的新实例，它包含指定目标、用户名和密码，然后进行获取Domain

public DirectoryContext (System.DirectoryServices.ActiveDirectory.DirectoryContextType contextType, string name, string username, string password);

参数
contextType
DirectoryContextType
DirectoryContextType 成员之一，它指定要创建的上下文的类型。
name
String
目录上下文的目标。 此字符串可以采用在 DirectoryContext 主题的“备注”部分中定义的任何格式。
username
String
要用于访问的用户名。
password
String
用于访问的密码。

调用[System.DirectoryServices.ActiveDirectory.Domain]::GetDo
main($DomainContext) 其中System.DirectoryServices.ActiveDirectory命名空间提供了一个围绕Microsoft ActiveDirectory服务任务构建的高级抽象对象模型。Active Directory服务概念(如森林、域、站点、子网、分区和模式)是对象模型的一部分。Domain 类表示 Active Directory 域，GetDomain(DirectoryContext) 获取指定上下文的 Domain 对象

3、如果未传入Credential，但是传入了Domain，则利用当前用户上下文的凭据信息，直接调用public DirectoryContext (System.DirectoryServices.ActiveDirectory.DirectoryContextType contextType, string name);函数，获取域的上下文，然后调用
[System.DirectoryServices.ActiveDirectory.Domain]::GetDomain($DomainContext)方法来获取域的相关信息

4、如果Domain和Credential都未传入，那么就调用[System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()表示获取获取当前的有效用户凭据的 Domain 对象