Scheduled Task to add users in multiple OUs to a group

Question

Hello,

I have my OUs structured so each department we're working with has an OU for their service accounts under their department OU.

e.g.

OU=Service Accounts,OU=Sales,OU=Department,DC=domain,DC=com
OU=Service Accounts,OU=Engineering,OU=Department,DC=domain,DC=com
OU=Service Accounts,OU=Support,OU=Department,DC=domain,DC=com

All accounts under those OUs should be a member of a specific Security group.

I see I can use value references in a template to point to the OU but I'm hoping it's possible to put a wildcard in the template like so:

OU=Service Accounts,OU=*,OU=Department,DC=domain,DC=com

I suppose this could be done with a powershell script but I wanted to see if there's a wildcard we can use for DNs in the built in scheduled tasks. It looks like I could also add each new OU to the scheduled task but I was hoping for something more hands off.

Answer 1

I went ahead and made a PowerShell script with the Adaxes cmdlets to do what I was trying to do.

$SRVAccounts = Get-ADMUser -AdaxesService Servername.domain.com -Filter * -Properties Name,DistinguishedName | `
    Where-Object {($_.DistinguishedName -like "*,OU=ServiceAccounts,OU=SharedAccounts,DC=domain,DC=com"`
    -or $_.DistinguishedName -like "*,OU=Service Accounts,*,OU=departments,DC=domain,DC=com")}

ForEach ($_ in $SRVAccounts) {Add-AdmGroupMember AddToGroupTest $_}

Comments

Made a small change to check to see if the user is a member of the group already before attempting to add. I also added the import module command so it works in the task scheduler.

Import-Module Adaxes
$SRVAccounts = Get-ADMUser -AdaxesService Servername.domain.com -Filter * -Properties Name,DistinguishedName | `
    Where-Object {($_.DistinguishedName -like "*,OU=ServiceAccounts,OU=SharedAccounts,DC=domain,DC=com"`
    -or $_.DistinguishedName -like "*,OU=Service Accounts,*,OU=departments,DC=domain,DC=com" -and $_.memberof -notlike "AddToGroupTest")}

ForEach ($_ in $SRVAccounts) {Add-AdmGroupMember AddToGroupTest $_}

---

Hello,

Actually, instead of using a script, you can use the ParentDN property. This is a constructed (virtual) property that returns the Distinguished Name (DN) of the container or OU where an object is located.

Thus, for your task, you can check whether the DN contains Service Accounts. Checking whether the user is already a member of the group is also a good idea. Thus, the actions/conditions of your Scheduled Task will look as follows:

To add, such actions/conditions to your task:

1. Add a new action to your Scheduled Task.
2. Select Add the User to a group.
3. Click Select Group and specify the necessary group.
   
4. Click OK 2 times.
5. Add a condition.
6. Select the If <property> <relation> <value> condition type.
7. In the Condition Parameters section, specify If ParentDN contains Service Accounts.
   
8. Click OK.
9. Add another condition. Select the If is member of <Group> condition type.
10. Select is not.
11. Click Select Group and specify the necessary group.
    
12. Click OK 2 times.

---

Thanks! I was just coming back to say the script works alone ok but within the Adaxes task scheduler it wasn't working quite like I wanted it to. I'll give the suggested setup a try and see how it works!

---

Thanks a bunch, that works exactly like I wanted!