通过使用Get-Adcomputer和Get-Wmiobject 组合来实现。
思路是这样的，先看一台服务器的属性值有什么可用利用的。
[12r2-dc]: PS C:\> Get-ADComputer -Identity 12r2-dc -Properties *
AccountExpirationDate :
accountExpires : 9223372036854775807
AccountLockoutTime :
AccountNotDelegated : False
AllowReversiblePasswordEncryption : False
AuthenticationPolicy : {}
AuthenticationPolicySilo : {}
BadLogonCount : 0
badPasswordTime : 0
badPwdCount : 0
CannotChangePassword : False
CanonicalName : abc.com/Domain Controllers/12R2-DC
Certificates : {System.Security.Cryptography.X509Certificates.X509Certificate}
CN : 12R2-DC
codePage : 0
CompoundIdentitySupported : {False}
countryCode : 0
Created : 10/9/2016 10:29:00 PM
createTimeStamp : 10/9/2016 10:29:00 PM
Deleted :
Description :
DisplayName :
DistinguishedName : CN=12R2-DC,OU=Domain Controllers,DC=abc,DC=com
DNSHostName : 12R2-DC.abc.com
DoesNotRequirePreAuth : False
dSCorePropagationData : {10/9/2016 10:29:03 PM, 12/31/1600 4:00:01 PM}
Enabled : True
HomedirRequired : False
HomePage :
instanceType : 4
IPv4Address : 169.254.15.118
IPv6Address :
isCriticalSystemObject : True
isDeleted :
KerberosEncryptionType : {RC4, AES128, AES256}
LastBadPasswordAttempt :
LastKnownParent :
lastLogoff : 0
lastLogon : 131498622097210925
LastLogonDate : 9/10/2017 11:04:43 PM
lastLogonTimestamp : 131495834837332604
localPolicyFlags : 0
Location :
LockedOut : False
logonCount : 1860
ManagedBy :
MemberOf : {CN=Pre-Windows 2000 Compatible Access,CN=Builtin,DC=abc,DC=com, CN=Cert
Publishers,CN=Users,DC=abc,DC=com}
MNSLogonAccount : False
Modified : 9/12/2017 7:23:19 PM
modifyTimeStamp : 9/12/2017 7:23:19 PM
msDFSR-ComputerReferenceBL : {CN=12R2-DC,CN=Topology,CN=Domain System
Volume,CN=DFSR-GlobalSettings,CN=System,DC=abc,DC=com}
msDS-GenerationId : {45, 30, 43, 189...}
msDS-SupportedEncryptionTypes : 28
msDS-User-Account-Control-Computed : 0
Name : 12R2-DC
nTSecurityDescriptor : System.DirectoryServices.ActiveDirectorySecurity
ObjectCategory : CN=Computer,CN=Schema,CN=Configuration,DC=abc,DC=com
ObjectClass : computer
ObjectGUID : bf0a2518-aa9c-4cb9-ab8e-09be04b3e27b
objectSid : S-1-5-21-2770570338-4234891044-2636713416-1001
OperatingSystem : Windows Server 2012 R2 Standard
OperatingSystemHotfix :
OperatingSystemServicePack :
OperatingSystemVersion : 6.3 (9600)
PasswordExpired : False
PasswordLastSet : 8/20/2017 4:58:11 PM
PasswordNeverExpires : False
PasswordNotRequired : False
PrimaryGroup : CN=Domain
看到这里就知道利用哪个属性值了，过滤一下，用一个通配符表达式或是任何一个能把这个值抓住的条件就可以，再用一个选择语句把名字选择出来。
$computer = Get-ADComputer -Filter {operatingsystem -like "*20*"} | select -ExpandProperty name
然后运行了一下Get-Wmiobject,结果如下：
[12r2-dc]: PS C:\> Get-WmiObject -Class win32_computersystem
Domain : abc.com
Manufacturer : Microsoft Corporation
Model : Virtual Machine
Name : 12R2-DC
PrimaryOwnerName : Windows User
TotalPhysicalMemory : 2094039040
然后想到，如果把变量$computer传递进来，再把两个属性暴露出来，就会产生一个结果集，当然，你愿意输出到文件自己再用管道符输出就是了。
Invoke-Command -ComputerName $computer {Get-WmiObject win32_computersystem} -ErrorAction SilentlyContinue | select name,model | sort model
结果就是：
Name Model
---- -----
12R2-SCCM Virtual Machine
本文出自 “沙丁鱼” 博客，请务必保留此出处http://shadingyu.blog.51cto.com/2617687/1965482
查找域内所有的Windows Server 2012 R2的服务器，并区分出哪些是物理机，那些是虚拟机
原文地址：http://shadingyu.blog.51cto.com/2617687/1965482
