Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How can I use PowerShell [adsisearcher] to query a domain that I am not a member of? Usually I will do something like this:

$myAdsi = [adsisearcher]""
$myAdsi.SearchRoot = [adsi]"LDAP://dc=corp,dc=mycompany,dc=com"
$myAdsi.Filter = "objectCategory=computer"

$res = $myAdsi.FindAll()

If I run this snippet on a host in my domain, I get the expected result. However, if I run this from a computer that has network access to the domain (through a L2L VPN) I get the error:

Exception calling "FindAll" with "0" argument(s): "The specified domain either does not exist or could not be contacted.
"
At line:11 char:33
+ $adComputers = $searcher.FindAll <<<< ()
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : DotNetMethodException

This is somewhat expected as I have not provided any sort of credentials to [adsisearcher] that would tell it how to authenticate. My question is: how do I let [adsisearcher] know that I want to authenticate against a domain in which I am not a member?

share|improve this question

1 Answer 1

up vote 3 down vote accepted

Edited out my last reply. Sorry it took me a while to get back to you. The following is shamelessly copied from http://powershell.com/cs/blogs/ebookv2/archive/2012/03/26/chapter-19-user-management.aspx :

[ADSI] is a shortcut to the DirectoryServices.DirectoryEntry .NET type. That’s why you could have set up the previous connection this way as well:

$domain = [DirectoryServices.DirectoryEntry]""
$domain
distinguishedName
-----------------
{DC=scriptinternals,DC=technet}

So try this to provide credentials to another domain:

$domain = new-object DirectoryServices.DirectoryEntry("LDAP://10.10.10.1","domain\user", "secret")
$domain.name
scriptinternals
$domain.distinguishedName
DC=scriptinternals,DC=technet

You are right, it's an authentication problem, even though I wish the error message was more accurate to reflect that. This should help you.

share|improve this answer
    
Yes, I can nslookup and ping corp.mycompany.com, with response originating from the DC responsible for the subnet that I am L2Ledd into –  tacos_tacos_tacos Jun 17 '12 at 0:35
    
1) All ports are open over the L2L –  tacos_tacos_tacos Jun 17 '12 at 1:02
    
2) I did not do a psexec or pssession but I did map a network drive with an administrator credential to get that going... –  tacos_tacos_tacos Jun 17 '12 at 1:02
    
Edited my reply. Hope that helps you. –  Ryan Ries Jun 20 '12 at 18:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.