Add users to group

Question

Hello,

I try to run following powershell code from Script Repository "Add users to group in bulk". I always get the message "User TestUser1 was not found".

We use Adaxes to manage more then 10 domains. I think the problematic line is with the Get-AdmUser command. When I remove "-AdaxesService localhost", script runs well in the domain where Adaxes server resides. Or if I specify an "Run as" account from the domain where the group resides - users were added to the group. But Custom Command should run in every Managed Domain with the configured Service Account.

regards Helmut

Comments

Hello,

This is exactly how the script is designed to work. It only searches for users in the domain where the group is located. Also, when you remove the -AdaxesService parameter for the Get-AdmUser cmdlet, the search is performed in AD avoiding Adaxes. In this case, users that are in the Adaxes unmanaged list can also be added to the group. We will update the script to add group members independently of their domain. Once the script is ready, we will get back to you right away.

Answer 1

Hello,

We updated the script to meet your needs. You can copy it here.

Comments

Hello,

thanks for updating script to our meets. I have an additional question: because our admin accounts are named in all manged Domain the same we get the message "Found more then one account..." How can we change the filter to search only in domain where the group resides?

regards Helmut

---

Hello Helmut,

It cannot be done by only updating the search filter. It is required to change the search base. Below is the version of the script that will perform the search only in the domain of the target group.

$propertyForUsernames = "adm-CustomAttributeText1" #TODO: modify me

function SearchObjects($filter)
{
    $searcher = $Context.BindToObjectByDN("%adm-DomainDN%")
    $searcher.SearchFilter = $filter
    $searcher.SearchScope = "ADS_SCOPE_SUBTREE"
    $searcher.SizeLimit = 2    

    try
    {
        # Execute search
        $searchResultIterator = $searcher.ExecuteSearch()
        $searchResults = $searchResultIterator.FetchAll()

        return ,$searchResults
    }
    finally
    {
        # Release resources
        if ($searchResultIterator){ $searchResultIterator.Dispose() }
    }
}

# Get usernames from the custom attribute
try
{
    $sAMAccountNames = ($Context.TargetObject.Get($propertyForUsernames)).Split(",")
}
catch
{
    return
}

# Get the current group members
try
{
    $memberGuidsBytes = $Context.TargetObject.GetEx("adm-DirectMembersGuid")
}
catch
{
    $memberGuidsBytes = @()
}

$memberGuids = New-Object "System.Collections.Generic.HashSet[System.Guid]"
$memberGuidsBytes | %%{ $memberGuids.Add([Guid]$_) }

$domainName = $Context.GetObjectDomain("%distinguishedName%")
foreach ($sAMAccountName in $sAMAccountNames)
{
    $searchResults = SearchObjects "(sAMAccountName=$sAMAccountName)"
    if ($searchResults.Length -eq 0)
    {
        $Context.LogMessage("Account with username $sAMAccountName not found.", "Warning")
        continue
    }
    elseif ($searchResults.Length -gt 1)
    {
        $Context.LogMessage("Found more than one account with username $sAMAccountName", "Warning")
        continue
    }

    # Add the user to the group
    $userGuid = [Guid]$searchResults[0].Properties["objectGUID"].Value
    if (-not($memberGuids.Contains($userGuid)))
    {
        try
        {
            $Context.TargetObject.Add("Adaxes://<GUID=$userGuid>")
        }
        catch
        {
            $Context.LogMessage("An error occurred when addingaccount with username $sAMAccountName to the group. Error: " + $_.Exception.Message, "Warning") # TODO: modify me
        }
    }
    else
    {
        $Context.LogMessage("User $sAMAccountName is already a member of the group.", "Information") # TODO: modify me
    }
}

# Clear custom attribute
$Context.TargetObject.Put($propertyForUsernames, $NULL)
$Context.TargetObject.SetInfoEx(@($propertyForUsernames))