Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Powershell: Find user who are member of a certain group that resides in some OU

Posted on 2013-12-03
13
Medium Priority
?
4,144 Views
Last Modified: 2013-12-10
Hi,

I have this script. I feed it usernames from a csv and it returns only the groupsnames the user is member of, who's names begin with "CTX"

Import-Module ActiveDirectory

$users = Import-CSV "C:\Temp\Migrate.csv" -Delimiter ';' | Select -ExpandProperty samaccountname
Get-ADUser -filter * -Properties memberof | Where {$_.memberof -match "CTX" -and $users -contains $_.samaccountname } | ForEach `
{
    $username = $_.samaccountname
    Get-ADPrincipalGroupMembership $username |
        Where {$_.name -like "CTX*"} |
        Select @{n="sAMAccountname";e={$username}},@{n="Groupname";e={$_.name}}
		
} | Export-CSV C:\Temp\Members.csv 

Open in new window


Th script works great. But, the organizational structure of the company I'm working at is changing and a few hundred new "CTX" groups are created, due to a new naming convention. For the time being, the old and new groups reside side by side in two different OU's.
Th problem is that users are member of both the "old" and the "new" group, so my output is heavily contaminated.
I would like the script to point to a specific OU, when looking for the groups a user is member of.
Can this be done and does anyone know how ?

Thanks in advance
0
Comment
Question by:Loyall
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 3
  • 3
  • +1
13 Comments
 
LVL 40

Expert Comment

by:Subsun
ID: 39693355
Add -SearchBase parameter to Get-ADUser in line 4.. so cmdlet will look users only in that specific OU.
Get-ADUser -SearchBase "OU=Accounts,OU=RootOU,DC=Domain,DC=com" -Properties memberof | Where {$_.memberof -match "CTX" -and $users -contains $_.samaccountname } | ForEach `

Open in new window

0
 
LVL 35

Expert Comment

by:YZlat
ID: 39693375
you could also add -SearchBase switch to your command. try something like that:

Import-Module ActiveDirectory

$users = Import-CSV "C:\Temp\Migrate.csv" -Delimiter ';' | Select -ExpandProperty samaccountname
Get-ADUser -SearchBase "OU=Test, ...." -filter * -Properties memberof | Where {$_.memberof -match "CTX" -and $users -contains $_.samaccountname } | ForEach `
{
    $username = $_.samaccountname
    Get-ADPrincipalGroupMembership $username -SearchBase "OU=Test, ...." |
        Where {$_.name -like "CTX*"} |
        Select @{n="sAMAccountname";e={$username}},@{n="Groupname";e={$_.name}}
		
} | Export-CSV C:\Temp\Members.csv 

Open in new window

0
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 2

Author Comment

by:Loyall
ID: 39693525
Hi,

It's not the users that are in a specific OU.
It's the groups they are member of...
0
 
LVL 41

Accepted Solution

by:
footech earned 2000 total points
ID: 39693558
You would have to modify the Where-Object filter on line 8 to match against the DistinguishedName of the group.  Something like the below.
        Where {$_.name -like "CTX*" -and $_.DistinguishedName -match "OU=newOU,DC=domain,DC=com"} |

Open in new window

0
 
LVL 35

Expert Comment

by:YZlat
ID: 39693569
you need to add -SearchBase switch to Get-ADPrincipalGroupMembership
0
 
LVL 40

Expert Comment

by:Subsun
ID: 39693574
Try changing $_.memberof -match "CTX" to
?{$_.memberof -match ".*CTX.*OU=Group,OU=Test,DC=Domain,DC=com"}
Replace OU=Group,OU=Test,DC=Domain,DC=com with your OU's DistinguishedName
0
 
LVL 40

Expert Comment

by:Subsun
ID: 39693582
I don't think there is a  -SearchBase parameter for Get-ADPrincipalGroupMembership..
0
 
LVL 2

Author Closing Comment

by:Loyall
ID: 39693823
Perfect solution. Thanks !
0
 
LVL 2

Author Comment

by:Loyall
ID: 39697628
Hmm, was testing it in a small test environment where it seemed to work. Now testing it in real life and the script gives also the groups from other OU's..

Situation:
OU_with_groups
                 OU_with_new_groups
                 OU_with_special_groups

I'm running the script against the "OU_with_groups", where the targeted CTX groups are, but it also gives me results from the nested OU_with_new_groups, OU_with_special_groups where different, not neede CTX groups are situated.

Script:
Import-Module ActiveDirectory

$users = Import-CSV "C:\Temp\Migration_CSV.csv" -Delimiter ';' | Select -ExpandProperty samaccountname
Get-ADUser -filter * -Properties memberof | Where {$_.memberof -match "CTX" -and $users -contains $_.samaccountname } | ForEach `
{
    $username = $_.samaccountname
    Get-ADPrincipalGroupMembership $username |
        Where {$_.name -like "CTX*" -and $_.DistinguishedName -match "OU=OU_with_groups,OU=Groups,OU=Company,DC=domain,DC=local"} |
        Select @{n="sAMAccountname";e={$username}},@{n="CTXGroup";e={$_.name}}
		
} | Export-CSV C:\Temp\CSV\01_CTXMembers.csv 

Open in new window

0
 
LVL 41

Expert Comment

by:footech
ID: 39704026
Try the following.
Import-Module ActiveDirectory

$users = Import-CSV "C:\Temp\Migration_CSV.csv" -Delimiter ';' | Select -ExpandProperty samaccountname
Get-ADUser -filter * -Properties memberof | Where {$_.memberof -match "CTX" -and $users -contains $_.samaccountname } | ForEach `
{
    $username = $_.samaccountname
    Get-ADPrincipalGroupMembership $username |
        Where {$_.name -like "CTX*" -and $_.DistinguishedName -match "(?<!,OU=.+?),OU=OU_with_groups,OU=Groups,OU=Company,DC=domain,DC=local"} |
        Select @{n="sAMAccountname";e={$username}},@{n="CTXGroup";e={$_.name}}
		
} | Export-CSV C:\Temp\CSV\01_CTXMembers.csv

Open in new window

0
 
LVL 2

Author Comment

by:Loyall
ID: 39704149
Thank you !
I will give it a try tomorrow and let you know.
0
 
LVL 2

Author Comment

by:Loyall
ID: 39708485
Hi Footech,

Tried it and it works perfect !
Thank you very, very much !
0

Featured Post

Office 365 Training for Admins - 7 Day Trial

Learn how to provision tenants, synchronize on-premise Active Directory, implement Single Sign-On, customize Office deployment, and protect your organization with eDiscovery and DLP policies.  Only from Platform Scholar.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In previous parts of this Nano Server deployment series, we learned how to create, deploy and configure Nano Server as a Hyper-V host. In this part, we will look for a clustering option. We will create a Hyper-V cluster of 3 Nano Server host nodes w…
There are times when we need to generate a report on the inbox rules, where users have set up forwarding externally in their mailbox. In this article, I will be sharing a script I wrote to generate the report in CSV format.
Learn several ways to interact with files and get file information from the bash shell. ls lists the contents of a directory: Using the -a flag displays hidden files: Using the -l flag formats the output in a long list: The file command gives us mor…
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an antispam), the admini…
Suggested Courses

722 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question