Public/Get-NSPEntraConnectSourceAnchor.ps1
|
function Get-NSPEntraConnectSourceAnchor { <# .SYNOPSIS Reports which source anchor Entra Connect Sync uses, and whether that is verified. Read-only. .DESCRIPTION Runs locally or through existing Windows PowerShell remoting with ComputerName. The remote server needs ADSync but no NSP installation. It reads the effective inbound user rules of every AD connector, not only the global setting, and returns: - Provenance: Verified or Unverified, with Reasons when Unverified. - Strategy: ObjectGuid, ConsistencyGuid, ConsistencyGuidWithObjectGuidFallback or Unknown. - Evidence: each flow into the anchor, with its rule, source object type and flow text, so an Unverified result can be diagnosed. Unverified blocks hard-match writes. A blank mS-DS-ConsistencyGuid on a user never proves the anchor is objectGUID, so user data plays no part here. The output names connectors and rules: treat it as topology and keep it out of Git and Coordination. .EXAMPLE $anchor = Get-NSPEntraConnectSourceAnchor $anchor.Provenance .EXAMPLE Get-NSPEntraConnectSourceAnchor -ComputerName sync01.example.test #> [CmdletBinding(SupportsShouldProcess)] [OutputType('NSP.M365.UserPairing.SourceAnchor')] param( [ValidatePattern('\A[A-Za-z0-9][A-Za-z0-9.-]{0,252}\z')][string]$ComputerName, [pscredential]$Credential ) $target = if ($ComputerName) { $ComputerName } else { $env:COMPUTERNAME } if (-not $PSCmdlet.ShouldProcess($target, 'Read effective Entra Connect sync rules')) { return } $options = @{} if ($ComputerName) { $options.ComputerName = $ComputerName } if ($Credential) { $options.Credential = $Credential } $state = Read-NSPEntraConnectState @options $collectedOn = if ($state.ComputerName) { [string]$state.ComputerName } else { $env:COMPUTERNAME } ConvertTo-NSPEntraSourceAnchorResult -Rule $state.Rule -Connector $state.Connector -GlobalParameter $state.GlobalParameter ` -ComputerName $collectedOn -ModuleVersion $state.ModuleVersion } |