Automate adding users into AD group if not found

Question

I am trying to set up a PS script to add members if they are not part of a group and run it as a task. Can someone proof the code and provide feedback? Thanks.

$GROUP = 'CN=Group1,OU=SomeOU,DC=domain,DC=local'

Get-ADUser -Filter * -SearchBase "DC=domain,DC=local" -Properties MemberOf | 
Where-Object {$_.MemberOf -notcontains $GROUP } | 
ForEach-Object { Add-ADGroupMember -Identity $GROUP -Members $_ }

Group should be an array : $GROUP = @('CN=Group1','OU=SomeOU','DC=domain,'DC=local') — jdweng
– jdweng, Commented Jan 3, 2023 at 17:59
@jdweng what are you talking about? that's a DistinguishedName.... — Santiago Squarzon
– Santiago Squarzon, Commented Jan 3, 2023 at 17:59
@jdweng, no, it isn't. A distinguished name is a single string that just so happens to be composed of multiple pieces of information internally. — mklement0
– mklement0, Commented Jan 3, 2023 at 22:47
@mklement0 : The string is not one object, it is four objects. — jdweng
– jdweng, Commented Jan 4, 2023 at 3:31

Santiago Squarzon · Accepted Answer · 2023-01-03 18:10:36Z

3

Code looks good but could be more efficient by leveraging the Active Directory Filter:

$group = 'CN=Group1,OU=SomeOU,DC=domain,DC=local'
Get-ADUser -LDAPFilter "(!memberof=$group)" -SearchBase "DC=domain,DC=local" |
    Add-ADPrincipalGroupMembership -MemberOf $group

-LDAPFilter "(!memberof=$group)" searches all users not being a member of your group which is by far more efficient than querying all users in your Search Base and then filtering with powershell.

edited Jan 3, 2023 at 18:10

answered Jan 3, 2023 at 18:00

Santiago Squarzon

65.7k5 gold badges26 silver badges60 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

a3kop Over a year ago

How would I exclude specific OU's from the -SearchBase? -notlike? Would I bring back the Where-Object?

Santiago Squarzon Over a year ago

you could use Where-Object in that case (where $_.DistinguishedName -notlike "*$ou" for example) Or you could loop over all OUs you want to target and pass each of them to -SearchBase. If that doesn't help please ask a new question with more details

a3kop Over a year ago

Like this? Where-Object { $_.DistinguishedName -notlike "*$ou" }

Santiago Squarzon Over a year ago

@a3kop yup, but that should only work for 1 OU only! if you need to exclude more then you need to enumerate them

Bacon Bits · Accepted Answer · 2023-01-03 18:00:13Z

2

I would probably use Add-ADPrincipalGroupMembership instead, which takes a user as the pipeline input and the group to add to as a parameter. Should perform a little better.

Get-ADUser -Filter * -SearchBase "DC=domain,DC=local" -Properties MemberOf | 
Where-Object MemberOf -notcontains $GROUP | 
Add-ADPrincipalGroupMembership -MemberOf $GROUP

answered Jan 3, 2023 at 18:00

Bacon Bits

32.5k6 gold badges64 silver badges79 bronze badges

Comments

js2010 · Accepted Answer · 2023-01-03 18:12:42Z

0

Something like this should work without dumping every user (-ne won't do what you want and the filter doesn't take -notcontains). -eq works with an array on the left. -not has a high precedence, so parentheses are needed.

get-aduser -filter "-not (memberof -eq '$group')" -property memberof -SearchBase 'DC=domain,DC=local'

edited Jan 3, 2023 at 18:12

answered Jan 3, 2023 at 18:06

js2010

28.3k6 gold badges82 silver badges88 bronze badges

Collectives™ on Stack Overflow

Automate adding users into AD group if not found

3 Answers 3

4 Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

4 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related