Script Repository


Add direct members of groups to Unmanaged Accounts

March 22, 2019
2080

The script adds users who are members of AD groups to Unmanaged Accounts. When adding users, only direct membership in the groups is taken into account.

To keep the list of Unmanaged Accounts in line with changes in your AD, you need to create a Scheduled Task configured for the Domain-DNS object type that runs the script and assign it over any of your AD domains.

Parameters:

  • $groupDNs - specifies the distinguished names (DNs) of the groups whose members will be added to Unmanaged Accounts;
  • $replaceCurrentlyUnmanagedAccounts - specifies whether to replace the accounts that are currently unmanaged with members of the groups or add the members to the existing Unmanaged Accounts list;
  • $excludeUserDNs - specifies the distinguished names (DNs) of the user accounts that should not be added to the unmanaged accounts list even if they are direct members of the groups specified in the $groupDNs variable. If all group members should be added to the list, leave the array empty.
Edit Remove
PowerShell
$groupDNs = @(
    "CN=My Group 1,CN=Users,DC=domain,DC=com", 
    "CN=My Group 2,CN=Users,DC=domain,DC=com") # TODO: modify me
$excludeUserDNs = @(
    "CN=My User 1,CN=Users,DC=domain,DC=com",
    "CN=My User 2,CN=Users,DC=domain,DC=com") # TODO: modify me

$replaceCurrentlyUnmanagedAccounts = $True # TODO: modify me

# Build filter to find users who are members of the specified groups
$groupMemberFilter = New-Object "System.Text.StringBuilder"
[void]$groupMemberFilter.Append("(&(sAMAccountType=805306368)")
foreach ($dn in $excludeUserDNs)
{
    $filterPart = [Softerra.Adaxes.Ldap.FilterBuilder]::Create("distinguishedName", $dn)
    [void]$groupMemberFilter.Append("(!$filterPart)")
}
[void]$groupMemberFilter.Append("(|")
foreach ($dn in $groupDNs)
{
    $filterPart = [Softerra.Adaxes.Ldap.FilterBuilder]::Create("memberOf", $dn)
    [void]$groupMemberFilter.Append($filterPart)
}
[void]$groupMemberFilter.Append("))")

# Find users and get their SIDs
$searcher = $Context.BindToObject("Adaxes://rootDse")
$searcher.SearchFilter = $groupMemberFilter.ToString()
$searcher.SearchScope = "ADS_SCOPE_SUBTREE"
$searcher.PageSize = 500
$searcher.ReferralChasing = "ADS_CHASE_REFERRALS_NEVER"
$searcher.SetPropertiesToLoad(@("objectSid"))
$searcher.VirtualRoot = $True

try
{
    $searchResultIterator = $searcher.ExecuteSearch()
    $searchResults = $searchResultIterator.FetchAll()
    
    $allUnmanagedSids = New-Object "System.Collections.Generic.HashSet[String]"
    foreach ($searchResult in $searchResults)
    {
        $sidBytes = $searchResult.Properties["objectSid"].Value
        $sid = New-Object "Softerra.Adaxes.Adsi.Sid" @($sidBytes, 0)
        [void]$allUnmanagedSids.Add($sid.Value)
    }
}
finally
{
    # Release resources
    if ($searchResultIterator){ $searchResultIterator.Dispose() }
}

# Add users to unmanaged accounts
$configurationSetSettingsPath = $Context.GetWellKnownContainerPath("ConfigurationSetSettings")
$configurationSetSettings = $Context.BindToObject($configurationSetSettingsPath)

if (!$replaceCurrentlyUnmanagedAccounts)
{
    # Fetch user accounts that are already unmanaged
    $currentUnmanagedAccounts = $configurationSetSettings.GetUnmanagedAccounts(@())
    $currentUnmanagedAccounts | %%{[void]$allUnmanagedSids.Add($_.Key)}
}

# Save changes
$configurationSetSettings.SetUnmanagedAccounts(@($allUnmanagedSids))

Comments ( 0 )
No results found.
Leave a comment

Related Scripts