• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1429
  • Last Modified:

Add users from an OU to a group, with users already belonging to

I cant find the correct way to add to a security AD Group all the users belonging to an OU. Specifically I encounter a problem when some of these users are already members of the group. I've tried the next syntax:

dsquery * "ou=ou,dc=domain,dc=com" -filter "(objectClass=user)" -limit 1000 | dsmod group "CN=group-name,ou=groups,dc=domain,dc=com" -c -addmbr

But the command exits with an error telling me that The user is already member of the group, and then exits with no changes made to the group.
0
begar
Asked:
begar
  • 3
  • 2
1 Solution
 
Farhan KaziSystems EngineerCommented:
Try this

FOR /F "delims=*" %u IN ('DSQuery * "ou=ou,dc=domain,dc=com" -Filter "(sAMAccountType=805306368)" -Limit 0') DO DSMod Group "cn=group-name,ou=groups,dc=domain,dc=com" -addmbr %u
0
 
begarAuthor Commented:
Thanks Farhankazi, half question is yours...but, could you be more explicit? There are 500 points on the table and I want yo know what is happening with my command. And of course, I want to understand your command too....I need to improve my skills ;)

thank u in advance
0
 
Farhan KaziSystems EngineerCommented:
There is nothing wrong with your command, you can say its a mystery. There are problems when you pipe DSAdd, DSMod, DSMov, DSRm with DSQuery. I have searched allot for its explanation /solution on many forums, MS articles but didn't find any solution other then using FOR command.  

In my solution I have used FOR loop.

FOR /F ["options"] %variable IN ('command') DO
Above loop type is used to parse the output of a 'command' (in our case command is DSQuery).
%variable holds the list of items that are outcome of a command (in our case %u which holds the users DN).
Delims=x  specifies a delimiter, this replaces the default delimiter that is space and tab (if I don't give delims=* then %u may hold incorrect DN if users CN contains any space. It will automatically break the line when ever it finds any space in user DN)

For more information about FOR loop you can use FOR /? on command line.

DSQuery * "ou=ou,dc=domain,dc=com" -Filter "(sAMAccountType=805306368)"
This statement will result ONLY user accounts that are inside the specified OU. (your statement was "(objectClass=user)" which may also include computer accounts.)

If you need further explanation do let me know.
0
 
begarAuthor Commented:
great! the 500 are yours...

I found another way to accomplish that  with the original Idea, the one with the pipe. What if I define a filter like (&(sAMAccountType=805306368)(!memberOf="cn=group,ou=domain,ou=com"))

:D   It takes much less time since the command is searching in a OU that hosts a thousand users. No users in the group, no errors, and no interruptions. Simply but effective.

Thank u again
0
 
Farhan KaziSystems EngineerCommented:
Excellent :)
Thanks for the points
0

Featured Post

Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

  • 3
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now