asked on

Add User to Group in AD

Hi,
I want to add a user to multiple security groups based on Title & Department.

The logic would be
1. User Department
2. User Title

I have already the Department in the user attribute in AD, I want the user to have a prompt to mention user's sam account & then the script query AD to check for Department.
Based on Department & Title the user should be added to Security Groups.

I tried this so far, but it fails to pass Department in variable:
----------------------------------
Import-Module ActiveDirectory
$user = Read-Host -Prompt "Enter Kürzel"
$Department = Get-ADUser -identity $user -Properties * | select Department
$Title = Get-ADUser -Identity $user -Properties * | select Title

if ($Department -eq 'Team Z' -eq "Director") { "w","w1" | Add-ADGroupMember -Members $user}
elseif ($Department -eq "Team Z" -and $Title -eq "Manager") { "w3","w4" | Add-ADGroupMember -Members $user }
------------------------------

$Department.gettype()
returns

IsPublic IsSerial Name BaseType
-------- -------- ---- --------
True False PSCustomObject System.Object

Same goes for $Title

Thanks in advance!

oBdA

You'd need a "Select-Object -ExpandProperty", otherwise you'll get an object with one single property.
But you shouldn't retrieve the same user twice, including all properties, just to then only use one single property.
Try it like this:

Import-Module ActiveDirectory
$user = Read-Host -Prompt "Enter Kürzel"
If ($ADUser = Get-ADUser -Identity $user -Properties Department, Title) {
	$Groups = $null
	If (($ADUser.Department -eq 'Team Z') -and ($ADUser.Title -eq "Director")) {
		$Groups = "w", "w1"
	} ElseIf (($ADUser.Department -eq "Team Z") -and ($ADUser.Title -eq "Manager")) {
		$Groups = "w3", "w4"
	}
	If ($Groups) {
		$Groups | Add-ADGroupMember -Members $user
	}
}

Open in new window

Ackles

ASKER

Looks Great, Thanks
Let me test & will come back!

Ackles

ASKER

it seems that if there is an existing group the user is already member of the script fails.
1. Is there a way to remove all the groups from user was previously member of & then add him to the groups mentioned?
2. There is also a condition where the user has no Title, I mean it will be like if he is neither manager or director?

One more thing would be cool if at the end the script displays what groups the user has been added, just for control...

Thanks!

Ackles

ASKER

ok, the 2nd part I could figure out.

oBdA

Try this:

Import-Module ActiveDirectory
$user = Read-Host -Prompt "Enter Kürzel"
If ($ADUser = Get-ADUser -Identity $user -Properties Department, MemberOf, Title) {
	$Groups = $null
	If (($ADUser.Department -eq 'Team Z') -and ($ADUser.Title -eq "Director")) {
		$Groups = "w", "w1"
	} ElseIf (($ADUser.Department -eq "Team Z") -and ($ADUser.Title -eq "Manager")) {
		$Groups = "w3", "w4"
	} Else {
		Write-Host "User does not meet the requirements of this script." -ForegroundColor Yellow
	}
	If ($Groups) {
		$ADuser.memberOf | ForEach-Object {
			Write-Host "[$($ADUser.SamAccountName)] Removing from $($_ -replace '\ACN=(.+?),(CN|DC)=.*', '$1') ..." -ForegroundColor White
			Remove-ADGroupMember -Identity $_ -Members $ADUser.SamAccountName
		}
		$Groups | ForEach-Object {
			Write-Host "[$($ADUser.SamAccountName)] Adding to $($_) ..." -ForegroundColor White -NoNewline
			Try {
				Add-ADGroupMember -Identity $_ -Members $ADUser.SamAccountName -ErrorAction Stop
				Write-Host " OK" -ForegroundColor Green
			} Catch {
				Write-Host $_.Exception.Message -ForegroundColor Yellow
			}
		}
	}
}

Open in new window

Ackles

ASKER

Sorry to have another request...
There are set of users which are not Department specific, meaning irrespective of Department they have to be added to Groups.
How would the condition be for them?

Ackles

ASKER

These users Title is either Praktikant or Praktikantin

So the condition would be

ElseIf (($ADUser.Title -eq "Praktikant") -or ($ADUser.Title -eq "Praktikantin"))

Is this correct?
Also would this also be correct:
ElseIf (($ADUser.Department -eq "Team Z") -and ($ADUser.Title -eq "Praktikant")-or ($ADUser.Title -eq "Praktikantin"))

ASKER CERTIFIED SOLUTION

oBdA

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

Ackles

ASKER

Looks Great!!
Let me check on Monday & then will mark answered, but as of now it's Awesome!

Ackles

ASKER

Hi,
Thanks, it works fine.
I have a leading question, please tell if can be answered in this or shall I open a new question?
We have Office 365 for emails & want to create same for adding user in Distribution Lists, in the same way...

oBdA

That should be its own question.

Ackles

ASKER

Thanks!

Ackles

ASKER

Awesome!

oBdA

Just noticed that a "?" was lost in the last/accepted script (doesn't create functional problems, just displays the OU name incorrectly).
Line 18 should be (an additional '?' directly after the "+" in "-replace '\ACN=(.+":

			Write-Host "[$($ADUser.SamAccountName)] Removing from $($_ -replace '\ACN=(.+?),(CN|DC)=.*', '$1') ..." -ForegroundColor White

Open in new window

Ackles

ASKER

Thanks!

Ackles

ASKER

Just a follow up for understanding:
would this also be correct:
ElseIf (($ADUser.Department -eq "Team Z") -and ($ADUser.Title -eq "Praktikant")-or ($ADUser.Title -eq "Consultant"))

What I want to achieve is 1 And 2 Or's

oBdA

No. "-and" has a higher precedence than "-or".
Just try it:

(1 -eq 2) -and (2 -eq 2) -or (3 -eq 3)

Open in new window

It would need to be

(($ADUser.Department -eq "Team Z") -and (($ADUser.Title -eq "Praktikant") -or ($ADUser.Title -eq "Consultant")))

Open in new window

But that's not easy to read. Use an array instead and check for membership in the array:

(($ADUser.Department -eq "Team Z") -and ("Consultant", "Praktikant", "Praktikantin" -contains $ADUser.Title))

Open in new window

Ackles

ASKER

Thanks a Million!
I will post the other question & request you for attention...