Solved

Script to Create AD Security Groups based on OU Membership

Posted on 2016-08-04

1 solution

36 Views

Last Modified: 2016-08-23

Hey Guys -

Quick question - we have a domain with numerous OUs nested within each other. Most are in the format below:

- AD Root
- Site
- Location
- Workstations
- Users
- Groups

The "Location" parent is the name of physical location and we have many across the country. What I am trying to do is create / locate a script or tool which will do the following:
- Obtain a list of members (device) in a specific "Location" OU (including children)
- Create an AD security group named after the "Location" which contains the same members

I can see where this may be doable fairly easily if I wanted to make a group named after an OU which the devices were immediately in, but am actually needing it to be the name of the OU one level up. I've got about 200 - 300 of these I want to create.

Any suggestions? Thanks!

Comment

Question by:BzowK

[X]

Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

Help others & share knowledge
Earn cash & points
Learn & ask questions

Join The Community

2 Comments

LVL 13

Accepted Solution

by:Dustin Saunders

Dustin Saunders earned 500 total points (awarded by participants)

ID: 417429542016-08-04

Something like this. Will look at adroot, get all the sites, then locations in each site. Then create 3 groups, one for users, one for computers, one for both. Then adds the users to the user group, computers to the computer group, and then those groups to the all objects group.

Be sure to test on a dummy OU.

$adRoot = "OU=Sites,DC=yourdomain,DC=local"

$sites = Get-ADOrganizationalUnit -Filter * -SearchBase $adRoot -SearchScope OneLevel

foreach ($site in $sites)
{
    $locations = Get-ADOrganizationalUnit -Filter * -SearchBase $site.DistinguishedName -SearchScope OneLevel
    
    foreach ($location in $locations)
    {

        $computerGroup = $location.Name + " - Computers"
        $userGroup = $location.Name + " - Users"
        $allGroup = $location.Name + " - All Objects"
        $groupOU = "OU=Groups," + $location.DistinguishedName

        
        New-ADGroup -Name $computerGroup -SamAccountName $computerGroup -Path $groupOU -GroupScope Global
        New-ADGroup -Name $userGroup -SamAccountName $userGroup -Path $groupOU -GroupScope Global
        New-ADGroup -Name $allGroup -SamAccountName $allGroup -Path $groupOU -GroupScope Global
        

        Add-ADGroupMember -Identity $allGroup -Members $userGroup
        Add-ADGroupMember -Identity $allGroup -Members $computerGroup
                
        Get-ADUser -searchbase $location.distinguishedName -filter * | %{Add-ADGroupMember -Identity $userGroup -Members $_}
        Get-ADComputer -searchbase $location.distinguishedName  -filter * | %{Add-ADGroupMember -Identity $computerGroup -Members $_}

    }

}

Open in new window

LVL 13

Expert Comment

by:Dustin Saunders

ID: 417666242016-08-23

The code provided works as intended (I've tested and verified on a test DC).

Featured Post

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Active Directory - Simple Tier Isolation

Article by: Shaun

This article demonstrates probably the easiest way to configure domain-wide tier isolation within Active Directory. If you do not know tier isolation read https://technet.microsoft.com/en-us/windows-server-docs/security/securing-privileged-access/s…

NewSID and Server 2008 R2 - fixing BSOD

Article by: NorthernTel & Telebec

For anyone that has accidentally used newSID with Server 2008 R2 (like I did) and hasn't been able to get the server running again because you were unlucky (as I was) and had no backups - I was able to get things working by doing a Registry Hive rec…

Windows Server 2008

Configuring Storage Pools in Backup Exec 2012

Video by: Rodney

To efficiently enable the rotation of USB drives for backups, storage pools need to be created. This way no matter which USB drive is installed, the backups will successfully write without any administrative intervention. Multiple USB devices need t…

Installing and Configuring Windows Server Backup Utility

Video by: Rodney

This tutorial will walk an individual through the steps necessary to install and configure the Windows Server Backup Utility. Directly connect an external storage device such as a USB drive, or CD\DVD burner: If the device is a USB drive, ensure i…