AD Tool/Script Populate Security Groups Automatically

Darrin Crawford
Darrin Crawford used Ask the Experts™
on
Looking for a simplistic tool/script to auto populate Security Group(s) in AD.

So the tool/script scans each User and if a particular Security Group(s) isn't in their Member of List, it gets populated.
Obviously need this run automatically every few days
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Chris DentPowerShell Developer
Top Expert 2010

Commented:
There are a few variations on this theme you might use. It uses the MS ActiveDirectory PowerShell module. Searches for everyone who isn't in the group, and adds them.
Get-ADUser -Filter { memberOf -ne 'CN=yourgroup,OU=somewhere,DC=domain,DC=local } | ForEach-Object {
    Add-ADGroupMember -Identity yourgroup -Member $_.DistinguishedName
}

Open in new window

The search might be a bit more constrained than that of course.
Information Security Officer
Commented:
Use the below script

# PowerShell script to ensure that all users in a specified OU
# are members of a specified group. Also ensure that there are
# no members of the group that are not user objects in the OU.

# Specify the OU.
$OU = [ADSI]"LDAP://ou=West,dc=MyDomain,dc=com"

# Specify the group.
$Group = [ADSI]"LDAP://cn=MyGroup,ou=West,dc=MyDomain,dc=com"

# Hash table of users in the OU.
$List = @{}

# Enumerate all objects in the OU.
$arrChildren = $OU.Get_Children()
ForEach ($Child In $arrChildren)
{
  # Only consider user objects.
  If ($Child.Class -eq "user")
  {
    # Add all users in the OU to the hash table.
    $List.Add($Child.distinguishedName, $True)
    # Check if user a member of the group.
    If ($Group.IsMember($Child.ADsPath) -eq $False)
    {
      # Add the user to the group.
      $Group.Add($Child.ADsPath)
      "Added " + $Child.distinguishedName
    }
  }
}

# Enumerate all members of the group.
ForEach ($Member in $Group.member)
{
  # Check if this member object is a user object in the OU.
  If ($List.ContainsKey($Member)-eq $False)
  {
    # Remove this member from the group.
    $Group.Remove("LDAP://$Member")
    "Removed " + $Member
  }
}

Open in new window

Author

Commented:
getting multiple errors from line 16
ForEach ($Child In $arrChildren)
  # Only consider user objects.
  If ($Child.Class -eq "user")  
    # Add all users in the OU to the hash table.
    $List.Add($Child.distinguishedName, $True)
    # Check if user a member of the group.
    If ($Group.IsMember($Child.ADsPath) -eq $False)
    {
      # Add the user to the group.
      $Group.Add($Child.ADsPath)
      "Added " + $Child.distinguishedName



PS C:\Windows\system32> C:\Users\darrin.crawford\Documents\Powershell_AD_Confluence Check.ps1
At C:\Users\darrin.crawford\Documents\Powershell_AD_Confluence Check.ps1:16 char:33
+ ForEach ($Child In $arrChildren)
+                                 ~
Missing statement body in foreach loop.
At C:\Users\darrin.crawford\Documents\Powershell_AD_Confluence Check.ps1:18 char:30
+   If ($Child.Class -eq "user")
+                              ~
Missing statement block after If ( condition ).
    + CategoryInfo          : ParserError: (:) [], ParentContainsErrorRecordException
    + FullyQualifiedErrorId : MissingForeachStatement
Ensure you’re charging the right price for your IT

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

Chris DentPowerShell Developer
Top Expert 2010

Commented:
You've stripped out "{" characters all over the place. They're not there as decoration.

Author

Commented:
Apologies, I didn't see the full script.

It is now working but has removed all users from this particular Security Group!!
Chris DentPowerShell Developer
Top Expert 2010
Commented:
The script you're using bases modification on presence in an OU. I can only assume the OU you've supplied contains none of the members.

You haven't stated the basis for auto-populating, so all you have so far are a few wide punts which may or may not apply to your own situation.

Author

Commented:
ok, got it, I needed to dig down into my OUs.

Thanks for your help

Author

Commented:
Thanks for the prompt reponses

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial