I am attempting to create a power shell script that prompts input for specific AD groups that a particular org manages that will essentially filter out users that are no longer in the said org and ONLY returns the 'samaccountname' and current department for those particular users. I have started but it does not seem to filter correctly. Any advice would be greatly appreciated.
Add-Type -AssemblyName Microsoft.VisualBasic
$groupName = [Microsoft.VisualBasic.Interaction]::InputBox("Please enter AD group name to display users no longer in department:", "XYZ", "$env")
Get-ADGroupMember -Identity $groupName -Recursive | Get-ADUser -Properties Department -Filter {enabled -eq $true} | ? {$_.DistinguishedName -notlike "*,OU=XYZ,*"} | Select-Object SamAccountName,Department
It appears it doesn't like the -Filter you have for Get-ADUser, I think (not 100% on this) it is because coming through the pipeline, it is sending one user at a time, so there isn't anything to filter.
Here's what I would do/try (maybe a better way, but testing this seems to get where you want to go):
$MatchedUsers=#{}
$GroupMembers=Get-ADGroupMember -Identity $groupName -Recursive | Get-ADUser -Properties Department
ForEach ($User in $GroupMembers) {
If (($User.Enabled -eq "True") -and ($User.DistinguishedName -notlike "*,OU=XYZ,*")) {
$MatchedUsers=#{
'SamAccountName'=$User.SamAccountName
'Department'=$User.Department
}
$obj=New-Object -TypeName PSObject -Property $MatchedUsers
Write-Output $obj
}
}
Related
We have a (2 way) trust relationship between 2 forests:
acme.com
someOtherForest.com
We have several subDomains in forest acme.com
domain1.acme.com
domain2.acme.com
I have (nested) groups in domain1.acme.com that contain both users in domain2.acme.com and foreignSecurityPrincipals from someOtherForest.com.
The server I am connected to uses a DC (dc1) on domain1.acme.com.
I have been using the following script to output all the members from a given group (recursively). It outputs foreignSecurityPrincipals as well as domain1 users perfectly fine, but errors on members who are from domain2:
$Groups = Get-ADGroup -Properties * -Filter * -SearchBase "CN=app-users,OU=app,DC=domain1,DC=acme,DC=com"
Foreach($G In $Groups) {
$members = Get-ADGroupMember $G -recursive | Get-ADUser -Properties Mail |Select-Object DistinguishedName,sAMAccountName, Mail |
Export-CSV -Path C:\output.csv -NoTypeInformation
}
If I add -server dc1:3268 (the GC of the DC) to the Get-AdUser section, then domain2 members are output fine, however it errors on foreignSecurityPrincipals.
Is there a way to output both foreignSecurityPrincipals and members from all subDomains of acme.com?
You're on the right track with using the GC port since that will take care of your forest.
But the problem is still the Foreign Security Principals. The documentation for Get-ADGroupMember says that it outputs "principal objects that represent users, computers or groups". So it'll only work for those three types of objects, not Foreign Security Principals.
That of course makes things a little more difficult for two reasons:
You don't have the ability to use the -Recursive property, so you have to handle that manually.
You still have to resolve the Foreign Security Principals.
This tipped me off that we can use Get-ADObject instead.
I was bored, so I wrote this for you. We do have a similar setup of domains here, so I was able to test it. But keep in mind that the domains are hard-coded. It assumes any foreign security principal will be on that one domain and not any other. So make sure you update the domain names (3 places).
It resolves the external accounts by taking the objectSid from the Foreign Security Principal, which is actually the SID of the account on the external domain, and using that to look up the user on that domain.
function Get-Members {
param([Microsoft.ActiveDirectory.Management.ADGroup]$group)
$members = $group | Select-Object -ExpandProperty Members | Get-ADObject -Server dc1:3268 -Properties Mail,SamAccountName,objectSid,ObjectClass
$returnMembers = New-Object System.Collections.ArrayList
foreach ($member in $members) {
if ($member.ObjectClass -eq "ForeignSecurityPrincipal") {
$returnMembers.Add((Get-ADUser -Server someOtherForest.com $member.objectSid -Properties Mail,SamAccountName)) | Out-Null
} elseif ($member.ObjectClass -eq "Group") {
$nestedMembers = (Get-Members ($member | Get-ADGroup -Properties Members))
if ($nestedMembers) {
if ($nestedMembers.Count -gt 1) {
$returnMembers.AddRange($nestedMembers) | Out-Null
} else {
$returnMembers.Add($nestedMembers) | Out-Null
}
}
} else {
$returnMembers.Add($member) | Out-Null
}
}
return $returnMembers
}
$Groups = Get-ADGroup -Server dc1:3268 -Properties Members -Filter * -SearchBase "CN=app-users,OU=app,DC=domain1,DC=acme,DC=com"
Foreach($G In $Groups) {
$members = Get-Members $G |Select-Object DistinguishedName,sAMAccountName, Mail |
Export-CSV -Path C:\output.csv -NoTypeInformation
}
Gabriel Luci's answer helped me edit my original script, to create a fast AD query that produces the same result set.
This is working for our setup, but I cannot be sure it would work for every AD setup.
WARNING: Errors that occur are suppressed using the -erroraction 'silentlycontinue' option.
This will display all members (domain, subdomain, and trusted Forest domains) of a group (in the server's domain) including nested groups. Each user will only appear once, regardless of how many nested groups they are a member of.
$set = New-Object 'System.Collections.Generic.HashSet[Microsoft.ActiveDirectory.Management.ADUser]'
$Groups = Get-ADGroup -Properties * -Filter * -SearchBase "CN=app-users,OU=app,DC=domain1,DC=acme,DC=com"
Foreach($G In $Groups)
{
$members = Get-ADGroupMember $G -recursive | Get-ADUser -Properties Mail -erroraction 'silentlycontinue'
$subDomainMembers = Get-ADGroupMember $G -recursive | Get-ADUser -Server dc1:3268 -Properties Mail -erroraction 'silentlycontinue'
Foreach ($i In $members){
$set.Add($i)| Out-Null
}
Foreach ($i In $subDomainMembers){
$set.Add($i)| Out-Null
}
}
$set |Select-Object -Unique DistinguishedName,sAMAccountName, Mail | Export-CSV -Path C:\output.csv -NoTypeInformation
I was wondering if this script could be changed into one for only active users?
import-module ActiveDirectory
Start-Transcript -Path "C:\test\teetest.txt"
$groups = Get-ADGroup -filter {(name -like "runners*") -or (name -like "helpers*")
foreach($group in $groups)
{
$countUser = (Get-ADGroupMember $group.DistinguishedName).count
Write-Host "The group $($group.Name) has $countUser user(s)."
}
Stop-Transcript
Any help would be appreciated.
If I understand your question correctly and by active users you mean groups with at least 1 member(i.e. greater than 0). You could just filter out results using Where-Object cmdlet. Like so:
$groups = Get-ADGroup -filter {(name -like "runners*") -or (name -like "helpers*") -Properties Members | Where-Object { $_.Members.Count –gt 0 }
Yes, you can add a filter to only get the number of active Members in the Group.
Since Get-ADGroupMember doesn't supply all properties for the Users you have to do another lookup for each of them:
$countUser = (Get-ADGroupMember $group.DistinguishedName | % { Get-ADuser -Identity $_ -Property Enabled | Where-Object {$_.Enabled -eq $true}}).count
Explanation:
% { Get-ADuser -Identity $_ -Property Enabled - Get the Informations for each User found in the Group with the Enabled Property added to it
Where-Object {$_.Enabled -eq $true} - Filters the users that are enabled
I think this may be because the Get-ADGroupMember not just returns user objects with a limited set of properties, but can also return groups and computers.
Since you are only looking for users that are direct descendents of the groups 'runners*' or 'helpers*', it is better to limit the objects returned by the Get-ADGroupMember cmdlet to be users only.
Below I do this by adding Where-Object { $_.objectClass -eq "user" }.
Next, to ensure the .Count property can be used I would suggest to enclose the thing in a #() so the returned value actually is an array and therefore has the Count property.
For a script like this, I also suggest NOT to try and put it all in one single line, because that makes spotting mistakes (like forgetting a closing bracket) more difficult.
Try this:
Start-Transcript -Path "C:\test\teetest.txt"
$groups = Get-ADGroup -Filter {(name -like "runners*") -or (name -like "helpers*")}
foreach($group in $groups) {
$countUser = 0
Get-ADGroupMember $group.DistinguishedName | Where-Object { $_.objectClass -eq "user" } |
ForEach-Object {
if ((Get-ADuser -Identity $_.DistinguishedName).Enabled) { $countUser++ }
}
Write-Host "The group $($group.Name) has $countUser user(s)."
}
Stop-Transcript
Replace the $countUser statement alone with below example.
For only Enabled User Accounts
$countUserEnabled = (get-aduser -filter *|where {$_.enabled -eq "True"}).count
For only Disabled User Accounts
$countUserDisabled = (get-aduser -filter *|where {$_.enabled -ne "False"}).count
hoping to get a little help here – I looked around the site but didn’t see anything quite like this (please direct me if there IS and I missed it).
I need to incorporate a new step in our user offboarding process, which would remove them from any AD Distribution Lists. I would like to set this up as a scheduled task to run once a night against two OU’s where the inactivated user accounts can be found.
I’d like to run this by pointing it at the USERS instead of the OU where the Distro Lists live, because I suspect that we’ll ultimately get the request to remove these users from OTHER types of group as well.
This snippet will remove AD Distro Lists from a single user, but leave all other types of AD groups alone:
# GroupCategory 0 = Distro List
# GroupCategory 1 = Security Group
# GroupScope 0 = DomainLocal
# GroupScope 1 = Global
# GroupScope 2 = Universal
$user = "userlogon"
Get-ADPrincipalGroupMembership -Identity $user|
Where {$_.GroupCategory -eq 0} |
ForEach {Remove-ADPrincipalGroupMembership -Identity $user -MemberOf $_ -Confirm:$false}
THIS snippet will look at an OU and return some info (just my example for using a variable with -searchbase):
$OUs = 'OU=PendingDeletion,OU=Users,DC=Stuff,DC=Place,DC=net','OU=HoldForReview,OU=Users,DC=Stuff,DC=Place,DC=net'
$OU | ForEach {Get-ADGroup -Filter * -Properties ManagedBy -SearchBase $_ } |
Select Name, ManagedBy |
Sort -Property Name
Out-GridView
BUT – Does it hold together that in order to complete my objective, I would do something like this?! I'm a bit out of my depth here, any advice for a re-write is appreciated:
$OUs = 'OU=PendingDeletion,OU=Users,DC=Stuff,DC=Place,DC=net','OU=HoldForReview,OU=Users,DC=Stuff,DC=Place,DC=net'
$user = "*"
$OUs | ForEach {
Get-ADPrincipalGroupMembership -Identity $user|
Where {$_.GroupCategory -eq 0} |
ForEach {Remove-ADPrincipalGroupMembership -Identity $user -MemberOf $_ -Confirm:$false}
}
There’s always a couple of ways to do stuff in PoSh, so I’m sure there’s a less-complicated way to do the same thing. If anyone has a different approach please feel free to suggest an alternative.
Thanks for taking a look!
So it sounds like you need three loops.
First, you will need to loop over the OU list to get the Users. We'll store the user objects in $Users
$OUs = 'OU=PendingDeletion,OU=Users,DC=Stuff,DC=Place,DC=net','OU=HoldForReview,OU=Users,DC=Stuff,DC=Place,DC=net'
$Users = ForEach ($OU in $OUs) {
Get-ADUser -Filter * -SearchBase $OU
}
Next loop over the users to get the groups that you want to remove. Then loop over the groups to remove each one.
ForEach ($User in $Users) {
Get-ADPrincipalGroupMembership -Identity $user |
Where-Object {$_.GroupCategory -eq 0} |
ForEach-Object {
Remove-ADPrincipalGroupMembership -Identity $user -MemberOf $_
}
}
I think I'd take this a little differently, by getting the group membership of all users, then grouping by AD group, and processing each group that way. Seems like it would be a lot fewer calls to AD. So I'd start out getting all of the users, just like BenH, except I would include their MemberOf property. Then I'd build a list of potential groups and filter down to just the Distribution Lists. I'd make a Hashtable of those as the keys, and make the value an array of each user that is in that group. Then loop through that removing the value of each from the associated key.
$OUs = 'OU=PendingDeletion,OU=Users,DC=Stuff,DC=Place,DC=net','OU=HoldForReview,OU=Users,DC=Stuff,DC=Place,DC=net'
$Users = ForEach ($OU in $OUs) {
Get-ADUser -Filter * -SearchBase $OU -Properties MemberOf
}
$UsersByGroup = #{}
ForEach($Group in ($Users.MemberOf | Select -Unique | Get-ADGroup | Where{ $_.GroupCategory -eq 0 })) {
$UsersByGroup.Add($Group.DistinguishedName,($Users | Where{ $Group.DistinguishedName -in $_.MemberOf}))
}
$UsersByGroup.Keys | ForEach{
Remove-ADGroupMember -Identity $_ -Members $UsersByGroup[$_] -Confirm:$false
}
We are looking to create a Powershell script that will automatically sort our user base by Country Code into two AD groups, one for English speakers, and one for French speakers. We are having challenges in getting this to work.
Each account should only be on one list, based on their country. The original source list of members for our list is Staff All, and we are looking into having two groups, one called Staff All EN, and the other called Staff All FR. It should also be able to exclude those in a Disabled OU for accounts that are no longer valid. (see below)
This is what we have so far:
$frenchCC = Get-Content .\CCFrench.txt
$staffAll = "CN=Staff-ALL,OU=Internal,OU=DistributionLists,OU=SFCG,DC=sfcg,DC=org"
$staffAllEn = "CN=Staff ALL EN,OU=Internal,OU=DistributionLists,OU=SFCG,DC=sfcg,DC=org"
$staffAllFr = "CN=Staff ALL FR,OU=Internal,OU=DistributionLists,OU=SFCG,DC=sfcg,DC=org"
$Target = Get-ADGroupMember -Identity $staffAll
We have tried several different approaches. The idea is to populate the French list from the AD based on the country code list. Populate the Staff-EN by copying the Staff-ALL list and then removing everyone in the French list.
And somewhere in the process, Remove everyone who is in HR-Disabled.
foreach ($Person in $Target) {
Add-ADGroupMember -Identity $staffAllEn -Members $Person.distinguishedname -confirm:$false
}
foreach ($Country in $frenchCC) {
Add-ADGroupMember -Identity $staffAllFr -Members (Get-ADUser -Filter '"$country"' -eq '") -confirm:$false
}
foreach ($Country in $frenchCC) {
Remove-ADGroupMember "Staff-ALL-EN" -Members (Get-ADUser -Filter $Country) -confirm:$false
}
$searchOU = Specify the OU where your groups are here (OU=Groups,DC=domain,DC=local)
Get-ADGroupMember Staff-ALL-EN -Properties Disabled | Remove-ADGroupMember Staff-ALL-EN
Get-ADGroupMember Staff-ALL-FR -Properties Disabled | Remove-ADGroupMember Staff-ALL-FR
In the source file for the country code, we have put the country codes in single quotes, double quotes and no quotes. with no difference.
This has really caught us in a pickle. Any suggestions would be appreciated.
I was able to work on the following for Brad, but I am not being able to make it run for each line in the text files (ex: multiple country codes). Anyone know what to change?
$frenchCC = Get-Content .\Countries.txt
$OUs = Get-Content .\OUs.txt
$userListFR = Get-ADUser -Filter {country -eq $frenchCC} -SearchBase $OUs -SearchScope OneLevel
$userListEN = Get-ADUser -Filter {country -ne $frenchCC} -SearchBase $OUs -SearchScope OneLevel
foreach($user in $userListFR) {add-adgroupmember "Staff-ALL-FR" -Members $user}
foreach($user in $userListEN) {add-adgroupmember "Staff-ALL-EN" -Members $user}
Im trying to get all AD users where the user in the manager field is disabled
The below does not work, ive tried multiple ways though cannot figure it out
Get-ADUser -SearchBase "XXX" -filter {enabled -eq $true} -Properties * | where {Get-aduser -Filter {distinguishedname -eq $_.manager -and enabled -eq $false}}
I don't have an AD readily available that has populated Manager attribute, so the script is not tested. Anyway, a simple way is to create two collections with Get-ADUser. Fill one with all the disabled accounts and one with enabled ones. Loop through the enabled accounts and check if manager is found from the disableds.
To make things faster, store the disabled accounts as a hash table with Group-Object and use hashtable's ContainsKey() method like so,
$disabled = Get-ADUser -filter { enabled -ne $true } | group-object `
-AsHashTable -AsString -Property Name
$users = Get-ADUser -filter { enabled -eq $true }
foreach($user in $users) {
if( $disabled.ContainsKey($user.Manager) ) {
# User's manager is a disabled account
}
}