Active Directory management & automation

Automatically Change Group Membership Using Scripts

With the help of Business Rules, Scheduled Tasks, and Custom Commands you can automatically add or remove AD objects from groups. For this purpose you usually use the Add Object to Group and Remove Object from Group actions. However, in scenarios where you need to deal with many groups and complex membership policies, you may prefer to use a script for this purpose.

To execute a script automatically, you need to add the Run a program or PowerShell script action to your Business Rule, Scheduled Tasks, or Custom Command.

Run PowerShell Script action.

Select PowerShell script in the Type field. In the Short description field, describe what does your script do, its purpose or intention.

Optionally, assign a custom description for the action

You can assign a custom description for the Run a program or PowerShell script action that will replace the default description generated by Adaxes. To do this:
  • Click the Assign Custom Action Description button.
  • Type the description in the Custom action description field.

    Add custom action description.

To execute PowerShell scripts, PowerShell must be installed on the computer, where the Adaxes service is running. To install PowerShell, visit Script Center Downloads and follow the instructions provided there.

To pass parameters to the script, you can use value references (e.g. %username%). Before the script is executed, value references will be replaced with the property values of the target AD object. For example, you can enter the following:
	$department = "%department%"
	$title = "%title%"
After the replacement of the value references, this part of the script will look as follows:
	$department = "Sales"
	$title = "Manager"

Also, to get the data entered by the user and access other parameters of the operation, you can use a predefined PowerShell variable called $Context. $Context is a pre-defined PowerShell variable of the ExecuteScriptContext class.

Example 1

Import-Module Adaxes

$userDN = "%distinguishedName%"

# If the department is 'Sales', the user must be a member of the 'Sales Staff' group
$department = "%department%"
$salesStaffGroup = Get-AdmGroup "Sales Staff"

if ($department -eq "Sales")
	# Add the user to the 'Sales Staff' group
	Add-AdmGroupMember $salesStaffGroup $userDN -ErrorAction SilentlyContinue
	# Remove the user from the 'Sales Staff' group
	Remove-AdmGroupMember $salesStaffGroup $userDN -Confirm:$False `
		-ErrorAction SilentlyContinue

# If the user is located under the 'New York' OU, add this user to
# the 'New York Office' group
$newYorkOUDN = "OU=New York,DC=example,DC=com"
$dn = New-Object "Softerra.Adaxes.Ldap.DN" $userDN
$userOUDN = $dn.Parent.ToString()

$newYorkGroup = Get-AdmGroup "New York Office"

if ($newYorkOUDN -eq $userOUDN)
	# Add the user to the 'New York Office' group
	Add-AdmGroupMember $newYorkGroup $userDN -ErrorAction SilentlyContinue
	# Remove the user from the 'New York Office' group
	Remove-AdmGroupMember $newYorkGroup $userDN -Confirm:$False `
		-ErrorAction SilentlyContinue

Example 2 - Remove a user from all groups

Import-Module Adaxes

$user = Get-AdmUser "%distinguishedName%" -Properties MemberOf

if ($user.MemberOf -ne $Null)
	foreach ($groupDN in $user.MemberOf)
		Remove-AdmGroupMember $groupDN -Members $user  -Confirm:$False

Example 3 - Remove a user from all mail-enabled groups

Import-Module Adaxes

$username = "%username%"
$domainName = $Null

Get-AdmPrincipalGroupMembership $username -server $domainName -adaxesservice localhost |
Get-AdmGroup -Properties mail -server $domainName | Where {$_.mail -ne $NULL} |
Remove-AdmGroupMember -member $username -server $domainName  -Confirm:$False

To use the scripts, you need to install Adaxes PowerShell Module on the computer, where your Adaxes service is running.
For information on how to create scripts for Business Rules, Custom Commands, and Scheduled Tasks, see Server-Side Scripting.

For a list of all cmdlets contained in the Adaxes PowerShell module, see Adaxes PowerShell Module.

? Waiting

Progress status: Checking...