Managing Active Directory can get complicated. Often, the native tools for managing AD are just not up to the task. The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.
Solved
Script to Create AD Security Groups based on OU Membership
Posted on 2016-08-04
Hey Guys -
Quick question - we have a domain with numerous OUs nested within each other. Most are in the format below:
- AD Root
- Site
- Location
- Workstations
- Users
- Groups
The "Location" parent is the name of physical location and we have many across the country. What I am trying to do is create / locate a script or tool which will do the following:
- Obtain a list of members (device) in a specific "Location" OU (including children)
- Create an AD security group named after the "Location" which contains the same members
I can see where this may be doable fairly easily if I wanted to make a group named after an OU which the devices were immediately in, but am actually needing it to be the name of the OU one level up. I've got about 200 - 300 of these I want to create.
Any suggestions? Thanks!
Quick question - we have a domain with numerous OUs nested within each other. Most are in the format below:
- AD Root
- Site
- Location
- Workstations
- Users
- Groups
The "Location" parent is the name of physical location and we have many across the country. What I am trying to do is create / locate a script or tool which will do the following:
- Obtain a list of members (device) in a specific "Location" OU (including children)
- Create an AD security group named after the "Location" which contains the same members
I can see where this may be doable fairly easily if I wanted to make a group named after an OU which the devices were immediately in, but am actually needing it to be the name of the OU one level up. I've got about 200 - 300 of these I want to create.
Any suggestions? Thanks!
[X]
Welcome to Experts Exchange
Add your voice to the tech community where 5M+ people just like you are talking about what matters.
- Help others & share knowledge
- Earn cash & points
- Learn & ask questions
2
2 Comments
Active 4 days ago
Something like this. Will look at adroot, get all the sites, then locations in each site. Then create 3 groups, one for users, one for computers, one for both. Then adds the users to the user group, computers to the computer group, and then those groups to the all objects group.
Be sure to test on a dummy OU.
Be sure to test on a dummy OU.
$adRoot = "OU=Sites,DC=yourdomain,DC=local"
$sites = Get-ADOrganizationalUnit -Filter * -SearchBase $adRoot -SearchScope OneLevel
foreach ($site in $sites)
{
$locations = Get-ADOrganizationalUnit -Filter * -SearchBase $site.DistinguishedName -SearchScope OneLevel
foreach ($location in $locations)
{
$computerGroup = $location.Name + " - Computers"
$userGroup = $location.Name + " - Users"
$allGroup = $location.Name + " - All Objects"
$groupOU = "OU=Groups," + $location.DistinguishedName
New-ADGroup -Name $computerGroup -SamAccountName $computerGroup -Path $groupOU -GroupScope Global
New-ADGroup -Name $userGroup -SamAccountName $userGroup -Path $groupOU -GroupScope Global
New-ADGroup -Name $allGroup -SamAccountName $allGroup -Path $groupOU -GroupScope Global
Add-ADGroupMember -Identity $allGroup -Members $userGroup
Add-ADGroupMember -Identity $allGroup -Members $computerGroup
Get-ADUser -searchbase $location.distinguishedName -filter * | %{Add-ADGroupMember -Identity $userGroup -Members $_}
Get-ADComputer -searchbase $location.distinguishedName -filter * | %{Add-ADGroupMember -Identity $computerGroup -Members $_}
}
}
Featured Post
Question has a verified solution.
If you are experiencing a similar issue, please ask a related question
In this post we will be converting StringData saved within a text file into a hash table. This can be further used in a PowerShell script for replacing settings that are dynamic in nature from environment to environment.
After seeing many questions for JRNL_WRAP_ERROR for replication failure, I thought it would be useful to write this article.
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource.
Use Google, Bing, or other preferred search engine to locate trusted NTP …
Sometimes it takes a new vantage point, apart from our everyday security practices, to truly see our Active Directory (AD) vulnerabilities. We get used to implementing the same techniques and checking the same areas for a breach. This pattern can re…
Suggested Courses
Course of the Month14 days, 22 hours left to enroll
649 members asked questions and received personalized solutions in the past 7 days.
Join the community of 500,000 technology professionals and ask your questions.