Automatically Change Group Membership Using Scripts

With the help of Business Rules, Scheduled Tasks, and Custom Commands you can automatically add or remove AD objects from groups. For this purpose you usually use the Add Object to Group and Remove Object from Group actions. However, in scenarios where you need to deal with many groups and complex membership policies, you may prefer to use a script for this purpose.

To execute a script automatically, you need to add the Run a program or PowerShell script action to your Business Rule, Scheduled Tasks, or Custom Command.

Select PowerShell script in the Type field. In the Short description field, describe what does your script do, its purpose or intention.

To pass parameters to the script, you can use value references (e.g. %username%). Before the script is executed, value references will be replaced with the property values of the target AD object. For example, you can enter the following:

    $department = "%department%"
    $title = "%title%"

    $department = "Sales"
    $title = "Manager"

Also, to get the data entered by the user and access other parameters of the operation, you can use a predefined PowerShell variable called $Context. For more details, please see Validate/Modify User Input Using a Script.

Example 1

    Import-Module Adaxes

    $userDN = "%distinguishedName%"

    # If the department is 'Sales', the user must be a member of the 'Sales Staff' group.
    $department = "%department%"
    $salesStaffGroup = Get-AdmGroup "Sales Staff"
    if ($department -eq "Sales")
    {
        # Add the user to the Sales Staff group
        Add-AdmGroupMember $salesStaffGroup $userDN -ErrorAction SilentlyContinue
    }
    else
    {
        # Remove the user from the Sales Staff group
        Remove-AdmGroupMember $salesStaffGroup $userDN -Confirm:$False `
            -ErrorAction SilentlyContinue
    }

    # If the user is located under the 'New York' OU, add this user to
    the 'New York Office' group
    $newYorkOUDN = "OU=New York,DC=example,DC=com"
    $dn = New-Object "Softerra.Adaxes.Ldap.DN" $userDN
    $userOUDN = $dn.Parent.ToString()
    $newYorkGroup = Get-AdmGroup "New York Office"
    if ($newYorkOUDN -eq $userOUDN)
    {
        # Add the user to the 'New York Office' group
        Add-AdmGroupMember $newYorkGroup $userDN -ErrorAction SilentlyContinue
    }
    else
    {
        # Remove the user from the 'New York Office' group
        Remove-AdmGroupMember $newYorkGroup $userDN -Confirm:$False `
            -ErrorAction SilentlyContinue
    }
  

    Import-Module Adaxes
    $user = Get-AdmUser "%distinguishedName%" -Properties MemberOf
    if ($user.MemberOf -ne $Null)
    {
        foreach ($groupDN in $user.MemberOf)
        {
            Remove-AdmGroupMember $groupDN -Members $user  -Confirm:$False
        }
    }
  

    Import-Module Adaxes
    $username = "%username%"
    $domainName = $Null

    Get-AdmPrincipalGroupMembership $username -server $domainName -adaxesservice localhost |
    Get-AdmGroup -Properties mail -server $domainName | Where {$_.mail -ne $NULL} |
    Remove-AdmGroupMember -member $username -server $domainName  -Confirm:$False