[SOLVED] Add Initiator to a new group automatically.

Question

EDIT: Actually, it would be better if I could just add the ownerDN to the groups automatically regardless of the initiator! Would that make it easier?

Hi All,

I have some workflows/Business Rules that create new shared folders with associated security groups that work very well but I want to enhance functionality so that the Initiator of the new folder/group is added as a member of the new group(s) IF they are the manager of those groups.
The powershell that does the creation is on the update of the user and here's the relevant bit:

# Get acl from template folder
$aclObject = Get-Acl $aclTemplateDirectoryPath

# Create a group and set permissions for Reviewers
$groupReviewersSid = CreateGroup $ouDN "$value-Reviewers"`
    "Shared Area - $value - Reviewers" "/SHA BLGEN $value - Reviewers"`
    "7577-$value-RX" $groupType $ownerDN
    UpdateAclObject $aclObject $value $groupReviewersSid "ReadAndExecute"

# Create a group and set permissions for Editors
$groupEditorsSid = CreateGroup $ouDN "$value-Editors"`
    "Shared Area - $value - Editors" "/SHA BLGEN $value - Editors"`
    "7577-$value-RWXD" $groupType $ownerDN
    UpdateAclObject $aclObject $value $groupEditorsSid "Modify"  

# Update acl for the new directory
Set-Acl $directory.FullName -AclObject $aclObject

So, if the Initiator = $ownerDN can the Initiator be added automatically?
Another wrinkle is that I have a business rule that asks for approval for users being added to groups, can this request bypass that?

Thanks
John.

Answer 1

Hello John,

For this purpose, you need to modify the CreateGroup function used in your script. Find below the function modified per requirements. We've added the following lines:

    # Add Owner to group
    $group.Add("Adaxes://$ownerDN")

Complete function:

# Function to create groups
function CreateGroup($ouDN, $name, $description, $displayName, $sAMAccountName, $groupType, $ownerDN)
{
    $ou = $Context.BindToObjectByDN($ouDN)
    $group = $ou.Create("group", "CN=$name")
    $group.Put("description", $description)
    $group.Put("displayName", $displayName)
    $group.Put("sAMAccountName", $sAMAccountName)
    $group.Put("groupType", [int]$groupType)
    $group.Put("managedBy", $ownerDN)
    $group.SetInfo()

    # Add Owner to group
    $group.Add("Adaxes://$ownerDN")

    $groupSid = $group.Get("objectSid")
    return ,$groupSid
}

Comments

Great, that all seems to work fine.

Thanks for your reply , much appreciated.