Solved

Script to Create AD Security Groups based on OU Membership

Posted on 2016-08-04
2
33 Views
Last Modified: 2016-08-23
Hey Guys -

Quick question - we have a domain with numerous OUs nested within each other.  Most are in the format below:

- AD Root
   - Site
      - Location
         - Workstations
         - Users
         - Groups

The "Location" parent is the name of physical location and we have many across the country.  What I am trying to do is create / locate a script or tool which will do the following:
- Obtain a list of members (device) in a specific "Location" OU (including children)
- Create an AD security group named after the "Location" which contains the same members

I can see where this may be doable fairly easily if I wanted to make a group named after an OU which the devices were immediately in, but am actually needing it to be the name of the OU one level up.  I've got about 200 - 300 of these I want to create.

Any suggestions?  Thanks!
0
Comment
Question by:BzowK
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
2 Comments
 
LVL 12

Accepted Solution

by:
Dustin Saunders earned 500 total points (awarded by participants)
ID: 41742954
Something like this.  Will look at adroot, get all the sites, then locations in each site.  Then create 3 groups, one for users, one for computers, one for both.  Then adds the users to the user group, computers to the computer group, and then those groups to the all objects group.

Be sure to test on a dummy OU.

$adRoot = "OU=Sites,DC=yourdomain,DC=local"

$sites = Get-ADOrganizationalUnit -Filter * -SearchBase $adRoot -SearchScope OneLevel

foreach ($site in $sites)
{
    $locations = Get-ADOrganizationalUnit -Filter * -SearchBase $site.DistinguishedName -SearchScope OneLevel
    
    foreach ($location in $locations)
    {

        $computerGroup = $location.Name + " - Computers"
        $userGroup = $location.Name + " - Users"
        $allGroup = $location.Name + " - All Objects"
        $groupOU = "OU=Groups," + $location.DistinguishedName

        
        New-ADGroup -Name $computerGroup -SamAccountName $computerGroup -Path $groupOU -GroupScope Global
        New-ADGroup -Name $userGroup -SamAccountName $userGroup -Path $groupOU -GroupScope Global
        New-ADGroup -Name $allGroup -SamAccountName $allGroup -Path $groupOU -GroupScope Global
        

        Add-ADGroupMember -Identity $allGroup -Members $userGroup
        Add-ADGroupMember -Identity $allGroup -Members $computerGroup
                
        Get-ADUser -searchbase $location.distinguishedName -filter * | %{Add-ADGroupMember -Identity $userGroup -Members $_}
        Get-ADComputer -searchbase $location.distinguishedName  -filter * | %{Add-ADGroupMember -Identity $computerGroup -Members $_}

    }

}

Open in new window

0
 
LVL 12

Expert Comment

by:Dustin Saunders
ID: 41766624
The code provided works as intended (I've tested and verified on a test DC).
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article explains the steps required to use the default Photos screensaver to display branding/corporate images
A project that enables an administrator to perform actions within a user session context not just at the time of login but any time later on day(s) or week(s) later.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
This tutorial will show how to configure a single USB drive with a separate folder for each day of the week. This will allow each of the backups to be kept separate preventing the previous day’s backup from being overwritten. The USB drive must be s…

730 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question