Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1095
  • Last Modified:

Powershell script to pull all AD accounts from a specified OU and add them as member into a Security Group

Is there a Powershell script that can pull all the users AD account from an OU and add them to a specific Security Group? I want to automate this and not have to rely on each site helpdesk to add manually as a member of this group when setting up a new user. A lot of time they forget so best way is having this scheduled to run daily.
0
CiscoAzn
Asked:
CiscoAzn
  • 5
  • 4
  • 3
1 Solution
 
becraigCommented:
something like this should work:

Get-ADUser -Filter * -SearchBase "OU=OU, DC=domain, DC=com" | % { add-adgroupmember  - identity <groupname> -member $_.samaccountname }

Open in new window

0
 
CiscoAznAuthor Commented:
No this did not work.
0
 
becraigCommented:
What specifically did not work ?

I am hoping you actually put in the right values for the OU and for the groupname  ?
0
Who's Defending Your Organization from Threats?

Protecting against advanced threats requires an IT dream team – a well-oiled machine of people and solutions working together to defend your organization. Download our resource kit today to learn more about the tools you need to build you IT Dream Team!

 
VB ITSSpecialist ConsultantCommented:
Try this:
Get-ADUser -SearchBase 'OU=Users,OU=Company,DC=domain,DC=com' -Filter * | % { Add-ADGroupMember 'Name of Security Group' -Members $_ }

Open in new window

Make sure you modify the bit after the -SearchBase switch to match your environment. Also change the 'Name of Security Group' to match the pre-Windows 2000 name of your group.
0
 
VB ITSSpecialist ConsultantCommented:
To elaborate, here's a screenshot of the properties of a Security Group where I changed it's name but not the pre-Windows 2000 name
Security-Group-Names.pngIf you look at the top bar, you'll see that I've named the group Dummy Group. If I then attempt to run the above script and use the group name Dummy Group then PowerShell will spit out an error for each and every user in the OU.

If I change the script to use the group name Security Group then it will work as expected and add all the users within the OU to the group.

Hope this clears things up.
0
 
CiscoAznAuthor Commented:
VB ITS ... this worked!! Can you tell me if you know how to pull multiple OU's into one single security group?
0
 
becraigCommented:
I am not sure what would have worked in the script VBITS provided that would not in mine since they are exactly the same thing ?

Are you asking to have the members of multiple OUs added to a single security group ?
If so, you can either populate a text file with all the OUs and simply pipe into a foreach loop.
0
 
CiscoAznAuthor Commented:
becraig,
Your script gave me multiple errors. Can you give me an example of what you're stating to populate all the OU's?
0
 
becraigCommented:
you can get all OUs using Get-ADOrganizationalUnit
e.g :
Get-ADOrganizationalUnit -Filter 'Name -like "*"' | FT Name, DistinguishedName -A

More info:

http://ss64.com/ps/get-adorganizationalunit.html
0
 
CiscoAznAuthor Commented:
That's not really helping me if there's no real examples that can be scripted and tested.
0
 
becraigCommented:
There are 3 examples on the page I provided the link to, but let me post them here:
Examples

Get all the Organizational Units in the domain:

PS C:\>
Get-ADOrganizationalUnit -Filter 'Name -like "*"' | FT Name, DistinguishedName -A

Open in new window


Gets the Organizational Unit with DistinguishedName 'OU=Sydney,OU=Demo,DC=SS64,DC=COM':

PS C:\>
Get-ADOrganizationalUnit -Identity 'OU=Sydney,OU=Demo,DC=SS64,DC=COM' | FT Name,Country,PostalCode,City,StreetAddress,State -A

Open in new window


Gets OUs underneath the 'Sydney' Organizational Unit using an LDAP filter:

PS C:\>
 Get-ADOrganizationalUnit -LDAPFilter '(name=*)' -SearchBase 'OU=Sydney,OU=Demo,DC=SS64,DC=COM' -SearchScope OneLevel | FT Name,Country,PostalCode,City,StreetAddress,State

Open in new window

0
 
VB ITSSpecialist ConsultantCommented:
You can use this CiscoAzn:
$OUs = 'OU=Users1,OU=Company,DC=domain,DC=com','OU=Users2,OU=Company,DC=domain,DC=com','OU=Users3,OU=Company,DC=domain,DC=com'

$OUs | ForEach { Get-ADUser -Filter * -SearchBase $_ | % { Add-ADGroupMember 'Name of Security Group' -Members $_ }}

Open in new window

Just modify the first line as needed and add/remove the DNs for your OUs separated by a comma.
0

Featured Post

Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

  • 5
  • 4
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now