New-ADClaimTransformPolicy

適用対象: Windows 8.1, Windows PowerShell 4.0, Windows Server 2012 R2

New-ADClaimTransformPolicy

Creates a new claim transformation policy object in Active Directory.

構文

Parameter Set: AllowAll
New-ADClaimTransformPolicy [-Name] <String> -AllowAll [-AuthType <ADAuthType> {Negotiate | Basic} ] [-Credential <PSCredential> ] [-Description <String> ] [-PassThru] [-ProtectedFromAccidentalDeletion <Boolean> ] [-Server <String> ] [-Confirm] [-WhatIf] [ <CommonParameters>]

Parameter Set: AllowAllExcept
New-ADClaimTransformPolicy [-Name] <String> -AllowAllExcept <ADClaimType[]> [-AuthType <ADAuthType> {Negotiate | Basic} ] [-Credential <PSCredential> ] [-Description <String> ] [-PassThru] [-ProtectedFromAccidentalDeletion <Boolean> ] [-Server <String> ] [-Confirm] [-WhatIf] [ <CommonParameters>]

Parameter Set: DenyAll
New-ADClaimTransformPolicy [-Name] <String> -DenyAll [-AuthType <ADAuthType> {Negotiate | Basic} ] [-Credential <PSCredential> ] [-Description <String> ] [-PassThru] [-ProtectedFromAccidentalDeletion <Boolean> ] [-Server <String> ] [-Confirm] [-WhatIf] [ <CommonParameters>]

Parameter Set: DenyAllExcept
New-ADClaimTransformPolicy [-Name] <String> -DenyAllExcept <ADClaimType[]> [-AuthType <ADAuthType> {Negotiate | Basic} ] [-Credential <PSCredential> ] [-Description <String> ] [-PassThru] [-ProtectedFromAccidentalDeletion <Boolean> ] [-Server <String> ] [-Confirm] [-WhatIf] [ <CommonParameters>]

Parameter Set: Identity
New-ADClaimTransformPolicy [-Name] <String> -Rule <String> [-AuthType <ADAuthType> {Negotiate | Basic} ] [-Credential <PSCredential> ] [-Description <String> ] [-Instance <ADClaimTransformPolicy> ] [-PassThru] [-ProtectedFromAccidentalDeletion <Boolean> ] [-Server <String> ] [-Confirm] [-WhatIf] [ <CommonParameters>]

詳細説明

The New-ADClaimTransformPolicy cmdlet creates a new claims transformation policy object in Active Directory. A claims transformation policy object contains a set of rules authored in the transformation rule language. After creating a policy object, you can link it with a forest trust to apply the claims transformation to the trust.

パラメーター

-AllowAll

Indicates that the policy sets a claims transformation rule that would allow all claims to be sent or received.

-AllowAllExcept<ADClaimType[]>

Specifies an array of claim types. When this parameter is specified, the policy sets a claims transformation rule that would allow all claims to be sent or received except for the specified claim types.

-AuthType<ADAuthType>

Specifies the authentication method to use. このパラメーターに対して使用できる値:

-- Negotiate or 0
-- Basic or 1

The default authentication method is Negotiate.

A Secure Sockets Layer (SSL) connection is required for the Basic authentication method.

-Credential<PSCredential>

Specifies a user account that has permission to perform this action. The default is the current user.

Type a user name, such as User01 or Domain01\User01, or enter a PSCredential object, such as one generated by the Get-Credential cmdlet. You will be prompted for a password if you type a user name.

This parameter is not supported by any providers installed with Windows PowerShell.

-DenyAll

Indicates that the policy sets a claims transformation rule that would deny all claims to be sent or received.

-DenyAllExcept<ADClaimType[]>

Specifies an array of claim types. When this parameter is specified, the policy sets a claims transformation rule that would deny all claims to be sent or received except for the specified claim types.

-Description<String>

Specifies a description of the object. This parameter sets the value of the Description property for the object. The Lightweight Directory Access Protocol (LDAP) display name (ldapDisplayName) for this property is description.

-Instance<ADClaimTransformPolicy>

Specifies an instance of an Active Directory object to use as a template for a new claims transformation policy object.

You can use an instance of an existing claims transformation policy object as a template or you can construct a new claims transformation policy object by using the Windows PowerShell command line or by using a script.

Method 1: Use an existing claims transformation policy object as a template for a new object. To retrieve an instance of an existing claims transformation policy object, use the Get-ADClaimTransformPolicy cmdlet. Then provide this object to the Instance parameter of the New-ADClaimTransformPolicy cmdlet to create a new claims transformation policy object. You can override property values of the new object by setting the appropriate parameters.

Method 2: Create a new ADClaimsTransformationPolicy and set the property values by using the Windows PowerShell command line interface. Then pass this object to the Instance parameter of the New-ADClaimTransformPolicy cmdlet to create the new Active Directory object.

Note: Specified attributes are not validated, so attempting to set attributes that do not exist or cannot be set will raise an error.

-Name<String>

Specifies the name of the object. This parameter sets the Name property of the Active Directory object. The LDAP display name (ldapDisplayName) of this property is name.

-PassThru

作業中の項目を表すオブジェクトを返します。既定では、このコマンドレットによる出力はありません。

-ProtectedFromAccidentalDeletion<Boolean>

Specifies whether to prevent the object from being deleted. When this property is set to $True, you cannot delete the corresponding object without changing the value of the property. このパラメーターに対して使用できる値:

-- $False or 0
-- $True or 1

-Rule<String>

Specifies the claims transformation rule. To specify the rule, you can either (1) type the rule in a text file, and then pass the file to the cmdlet (recommended), or (2) type the rule inline.

For instance, the following commands demonstrate how to create a new claims transformation policy object with the rule specified in a text file named Rule.txt located in a temporary folder C:\temp.

$Rule = Get-Content C:\temp\rule.txt;

New-ADClaimTransformPolicy MyRule -Rule $Rule

-Server<String>

Specifies the Active Directory ドメイン サービス instance to connect to, by providing one of the following values for a corresponding domain name or directory server. The service may be any of the following: Active Directory Lightweight Domain Services, Active Directory ドメイン サービス or Active Directory snapshot instance.

Specify the Active Directory ドメイン サービス instance in one of the following ways:

Domain name values:

-- Fully qualified domain name
-- NetBIOS name

Directory server values:

-- Fully qualified directory server name
-- NetBIOS name
-- Fully qualified directory server name and port

The default value for this parameter is determined by one of the following methods in the order that they are listed:

-- By using the Server value from objects passed through the pipeline
-- By using the server information associated with the Active Directory ドメイン サービス Windows PowerShell provider drive, when the cmdlet runs in that drive
-- By using the domain of the computer running Windows PowerShell

-Confirm

コマンドレットを実行する前に、ユーザーに確認を求めます。

-WhatIf

コマンドレットを実行するとどのような結果になるかを表示します。コマンドレットは実行されません。

<CommonParameters>

このコマンドレットは次の共通パラメーターをサポートします。-Verbose、-Debug、-ErrorAction、-ErrorVariable、-OutBuffer、-OutVariable.詳細については、以下を参照してください。 about_CommonParameters (https://go.microsoft.com/fwlink/p/?LinkID=113216)。

入力

入力型は、コマンドレットにパイプできるオブジェクトの型です。

• None or Microsoft.ActiveDirectory.Management.ADClaimTransformPolicy

  Specifies a claims transformation policy object that is a template for the new claims transformation policy object is received by the Instance parameter.

出力

出力型は、コマンドレットによって生成されるオブジェクトの型です。

• None or Microsoft.ActiveDirectory.Management.ADClaimTransformPolicy

注

• This cmdlet does not work with an Active Directory snapshot.

• This cmdlet does not work with a read-only domain controller.

例

Example 1: Create a new claims transformation policy by name that denies all claims

This command creates a new claims transformation policy named DenyAllPolicy that denies all claims, both those that are sent as well as those that are received.

PS C:\> New-ADClaimTransformPolicy -Name "DenyAllPolicy" -DenyAll

Example 2: Create a new claim transformation policy by name with exclusions

This command creates a new claims transformation policy named AllowAllExceptCompanyAndDepartmentPolicy that allows all claims to be sent or received except for the claims Company and Department.

PS C:\> New-ADClaimTransformPolicy -Name "AllowAllExceptCompanyAndDepartmentPolicy" -AllowAllExcept Company,Department

Example 3: Create a new claim transformation policy that changes an existing name to a new name

This command creates a new claims transformation policy named HumanResourcesToHrPolicy that transforms the value Human Resources to HR in the claim Department.

PS C:\> New-ADClaimTransformPolicy -Name "HumanResourcesToHrPolicy" -Rule 'C1:[Type=="ad://ext/Department:88ceb0fe88a125db", Value=="Human Resources", ValueType=="string"] => issue(Type=C1.Type, Value="HR", ValueType=C1.ValueType);'

Example 4: Create a new claims transformation policy by name using a rule specified in a file

This example creates a new claims transformation policy named MyRule with the rule specified in C:\rule.txt.

PS C:\> $Rule = Get-Content C:\rule.txt
PS C:\> New-ADClaimTransformPolicy -Name "MyRule" -Rule $Rule

関連トピック

Get-ADClaimTransformPolicy

Remove-ADClaimTransformPolicy

Set-ADClaimTransformPolicy

AD DS Administration Cmdlets in Windows PowerShell