Solved

Powershell - If statements based on AD Security group memberships

Posted on 2016-11-28
2
24 Views
Last Modified: 2016-11-28
Good Day,

I have a powershell script and I am trying to pass different IF statements based on the currentuser's group membership.

$CurrentUser = $env:USERNAME
$Authorized = get-aduser -Identity $CurrentUser

IF ( (($Authorized).memberof -ne 'GROUP-A' ) -or (($Authorized).memberof -ne 'GROUP-B' )) {
      Write-Host "Unauthorized User - Exiting..."
      Write-Host ""
      PAUSE
      EXIT
}


Then later in the script I call:

If (($Authorized).memberof -eq 'GROUP-A'){
            #Total Size of Archived Directory
            Write-Output ""
            Write-Host ""
            Write-Output ""
            Write-Host ""
}

This last section does not ever provide the correct output.  The $Currentuser is a member of multiple groups and I want this last section to run if the $CurrentUser is a member of this AD security group which this member is.

Thank you in advance for your help.
0
Comment
Question by:mrfite
2 Comments
 
LVL 83

Accepted Solution

by:
oBdA earned 500 total points
ID: 41904369
- The memberOf attribute is not returned by default
- You're trying to compare a string scalar against an array.

* To test whether a single string is contained in an array, use the -contains operator
* To test whether at least one string is contained in both arrays, you can use Compare-Object
$ADUser = Get-ADUser -Identity $ENV:UserName -Property memberOf
$Membership = $ADUser.memberOf | ForEach-Object {($_ -split '(?:\A|,)CN=|,OU=', 3)[1]}
$AllowGroups = @(
	'Group-A'
	'Group-B'
	'Domain Admins'
)
If (-not (Compare-Object -ReferenceObject $AllowGroups -DifferenceObject $Membership -ExcludeDifferent -IncludeEqual)) {
	# Unauthorized
	# ...
}

If ($Membership -contains 'Group-A') {
	# Member of Group-A
	# ...
}

Open in new window

0
 

Author Closing Comment

by:mrfite
ID: 41904582
Thank you! - This worked just like you said it would.
0

Featured Post

Best Practices: Disaster Recovery Testing

Besides backup, any IT division should have a disaster recovery plan. You will find a few tips below relating to the development of such a plan and to what issues one should pay special attention in the course of backup planning.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Microsoft Windows Server Update Service (WSUS) is free for everyone, but it lacks of some desirable features like send an e-mail to the administrator with the status of all computers on the WSUS server. This article is based on my PowerShell script …
I thought I'd write this up for anyone who has a request to create an anonymous whistle-blower-type submission form created using SharePoint 2010 (this would probably work the same for 2013). It's not 100% fool-proof but it's as close as you can get…
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …

863 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now