windows 在命令行验证域凭据
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/5379431/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Verify domain credentials at command line
提问by jing
Is there a windows command that will allow me to verify a domain account/password?
是否有允许我验证域帐户/密码的 Windows 命令？
回答by Hyman B Nimble
You could use the command RUNAS, it is not technically a commandline to validate credentials, but it CAN be used for that.
您可以使用命令RUNAS，它在技术上不是验证凭据的命令行，但可以用于此目的。
runas /noprofile /user:mycomputer\administrator "notepad"
If it fails it returns:
如果失败则返回：
RUNAS ERROR: Unable to run - notepad
1326: Logon failure: unknown user name or bad password.
回答by JLA
RUNAS works great on a local system.
RUNAS 在本地系统上运行良好。
To verify credentials on a remote computer, I use the PSExec tool from SysInternals. I specify the username, then it prompts me for the password. Here is an example of what my command looks like:
为了验证远程计算机上的凭据，我使用了 SysInternals 的 PSExec 工具。我指定了用户名，然后它提示我输入密码。这是我的命令的示例：
psexec \RemoteComputer -u DOMAIN\USER cmd.exe
If I enter the correct password, I'll be greeted with a command prompt. If I enter the wrong password, I get this:
如果我输入正确的密码，我会看到一个命令提示符。如果我输入错误的密码，我会得到这个：
PsExec could not start cmd.exe on RemoteComputer:
The user name or password is incorrect.
回答by Terry
You can use this powershell script which does some extra testing (domain reachable, user name exists, account enabled, account unlocked). Got this script from this post. Put this in a notepad, save as .ps1 and execute. It will prompt for credentials and provide feedback. Worked perfectly for my needs.
您可以使用此 powershell 脚本进行一些额外的测试（域可达、用户名存在、帐户已启用、帐户已解锁）。从这篇文章中得到了这个脚本。将其放在记事本中，另存为 .ps1 并执行。它将提示输入凭据并提供反馈。非常适合我的需求。
<#
.SYNOPSIS
Test domain username/password combination are correct
.DESCRIPTION
This script will check if the password for a given username is correct. If the authentication failed using the provided Domain\Username and Password.
The script will do some checks and provide some clues why the authentication failed.
The checks are:
* Domain is reachable.
* User Name exists in the domain.
* The account is Enabled.
* The account is Unlocked.
.EXAMPLE
.\Test-UserCredentials.ps1
or
Right click the script and select "Run with PowerShell"
.Notes
Created by: Ibrahim Soliman
Version: 1.6 (Enhanced error handling, and authentication failure root cause analysis.)
#>
#Import Active Directory Module
Import-Module Activedirectory
#Clear User Info Function
Function ClearUserInfo
{
$Cred = $Null
$DomainNetBIOS = $Null
$UserName = $Null
$Password = $Null
}
#Rerun The Script Function
Function Rerun
{
$Title = "Test Another Credentials?"
$Message = "Do you want to Test Another Credentials?"
$Yes = New-Object System.Management.Automation.Host.ChoiceDescription "&Yes", "Test Another Credentials."
$No = New-Object System.Management.Automation.Host.ChoiceDescription "&No", "End Script."
$Options = [System.Management.Automation.Host.ChoiceDescription[]]($Yes, $No)
$Result = $host.ui.PromptForChoice($Title, $Message, $Options, 0)
Switch ($Result)
{
0 {TestUserCredentials}
1 {"End Script."}
}
}
#Test User Credentials Function
Function TestUserCredentials
{
ClearUserInfo
#Get user credentials
$Cred = Get-Credential -Message "Enter Your Credentials (Domain\Username)"
if ($Cred -eq $Null)
{
Write-Host "Please enter your username in the form of Domain\UserName and try again" -BackgroundColor Black -ForegroundColor Yellow
Rerun
Break
}
#Parse provided user credentials
$DomainNetBIOS = $Cred.username.Split("{\}")[0]
$UserName = $Cred.username.Split("{\}")[1]
$Password = $Cred.GetNetworkCredential().password
Write-Host "`n"
Write-Host "Checking Credentials for $DomainNetBIOS$UserName" -BackgroundColor Black -ForegroundColor White
Write-Host "***************************************"
If ($DomainNetBIOS -eq $Null -or $UserName -eq $Null)
{
Write-Host "Please enter your username in the form of Domain\UserName and try again" -BackgroundColor Black -ForegroundColor Yellow
Rerun
Break
}
# Checks if the domain in question is reachable, and get the domain FQDN.
Try
{
$DomainFQDN = (Get-ADDomain $DomainNetBIOS).DNSRoot
}
Catch
{
Write-Host "Error: Domain was not found: " $_.Exception.Message -BackgroundColor Black -ForegroundColor Red
Write-Host "Please make sure the domain NetBios name is correct, and is reachable from this computer" -BackgroundColor Black -ForegroundColor Red
Rerun
Break
}
#Checks user credentials against the domain
$DomainObj = "LDAP://" + $DomainFQDN
$DomainBind = New-Object System.DirectoryServices.DirectoryEntry($DomainObj,$UserName,$Password)
$DomainName = $DomainBind.distinguishedName
If ($DomainName -eq $Null)
{
Write-Host "Domain $DomainFQDN was found: True" -BackgroundColor Black -ForegroundColor Green
$UserExist = Get-ADUser -Server $DomainFQDN -Properties LockedOut -Filter {sAMAccountName -eq $UserName}
If ($UserExist -eq $Null)
{
Write-Host "Error: Username $Username does not exist in $DomainFQDN Domain." -BackgroundColor Black -ForegroundColor Red
Rerun
Break
}
Else
{
Write-Host "User exists in the domain: True" -BackgroundColor Black -ForegroundColor Green
If ($UserExist.Enabled -eq "True")
{
Write-Host "User Enabled: "$UserExist.Enabled -BackgroundColor Black -ForegroundColor Green
}
Else
{
Write-Host "User Enabled: "$UserExist.Enabled -BackgroundColor Black -ForegroundColor RED
Write-Host "Enable the user account in Active Directory, Then check again" -BackgroundColor Black -ForegroundColor RED
Rerun
Break
}
If ($UserExist.LockedOut -eq "True")
{
Write-Host "User Locked: " $UserExist.LockedOut -BackgroundColor Black -ForegroundColor Red
Write-Host "Unlock the User Account in Active Directory, Then check again..." -BackgroundColor Black -ForegroundColor RED
Rerun
Break
}
Else
{
Write-Host "User Locked: " $UserExist.LockedOut -BackgroundColor Black -ForegroundColor Green
}
}
Write-Host "Authentication failed for $DomainNetBIOS$UserName with the provided password." -BackgroundColor Black -ForegroundColor Red
Write-Host "Please confirm the password, and try again..." -BackgroundColor Black -ForegroundColor Red
Rerun
Break
}
Else
{
Write-Host "SUCCESS: The account $Username successfully authenticated against the domain: $DomainFQDN" -BackgroundColor Black -ForegroundColor Green
Rerun
Break
}
}
TestUserCredentials
ClearUserInfo
