在AD域迁移后使用powershell进行权限映射

$oldDomainUsers = Get-ADUser -Server <旧域控制器> -Filter *
$oldDomainGroups = Get-ADGroup -Server <旧域控制器> -Filter *

$oldDomainUsers | ForEach-Object {
    $newUser = New-ADUser -SamAccountName $_.SamAccountName -UserPrincipalName $_.UserPrincipalName -Name $_.Name -GivenName $_.GivenName -Surname $_.Surname -Server <新域控制器>
    # 将旧域用户的属性映射到新域用户
    # ...
}

$oldDomainGroups | ForEach-Object {
    $newGroup = New-ADGroup -SamAccountName $_.SamAccountName -Name $_.Name -GroupCategory $_.GroupCategory -GroupScope $_.GroupScope -Server <新域控制器>
    # 将旧域组的属性映射到新域组
    # ...
}

$oldDomainUsers | ForEach-Object {
    $userSID = (New-Object System.Security.Principal.NTAccount($_.SamAccountName)).Translate([System.Security.Principal.SecurityIdentifier]).Value
    $newUser = Get-ADUser -Server <新域控制器> -Filter { SID -eq $userSID }
    # 将旧域用户的权限映射到新域用户
    # ...
}

$oldDomainGroups | ForEach-Object {
    $groupSID = (New-Object System.Security.Principal.NTAccount($_.SamAccountName)).Translate([System.Security.Principal.SecurityIdentifier]).Value
    $newGroup = Get-ADGroup -Server <新域控制器> -Filter { SID -eq $groupSID }
    # 将旧域组的权限映射到新域组
    # ...
}