Remove user from any group "starting with"

Question

1. Every role-based-group starts with "arbg-"
2. Users should only be in 1 arbg- group

To enforce this, on any user change I would like to remove them from any "arbg-" group they are currently in and re-add them based on the original logic (department number, Job title, etc)

In effect this is the powershell command Get-ADPrincipalGroupMembership -Identity <SamAccount> | Select Name | Where-Object {$_.Name -Like 'ARBG*'}

Answer 1

Hello,

It can be done using a business rule triggering After adding a member to a group and the below PowerShell script. The rule will look like the following:

$filterPart = [Softerra.Adaxes.Ldap.FilterBuilder]::Create("distinguishedName", "%distinguishedName%")

$searcher = $Context.BindToObject("Adaxes://%member%")
$searcher.SearchFilter = "(&(objectCategory=group)(name=arbg-*)(!$filterPart))"
$searcher.SearchScope = "ADS_SCOPE_BASE"
$searcher.PageSize = 500
$searcher.AttributeScopeQuery = "memberOf"

try
{
    # Execute search
    $searchIterator = $searcher.ExecuteSearch()
    $searchResults = $searchIterator.FetchAll()

    if ($searchResults.Length -eq 0)
    {
        return
    }

    foreach ($searchResult in $searchResults)
    {
        $group = $Context.BindToObjectBySearchResult($searchResult)
        $group.Remove("Adaxes://%member%")
    }
}
finally
{
    # Release resources
    if ($searchIterator){ $searchIterator.Dispose() }
}

Comments

With LDAP Filters no longer being supported with 2023.2, what is the proper script using Criteria?

I want a custom command that runs the script on all users the command is being ran against to remove all group the member is a part of that start with "BTPAM."

---

Is it possible to get an updated version of this script, I could use it aswell.

---

Hello,

Here is the updated script using criteria instead of the LDAP filter.

# Build criteria
$criteria = New-AdmCriteria "group" -Expression {(name -startsWith "arbg-") -and (distinguishedName -ne "%distinguishedName%")}

# Search parameters
$searcher = $Context.BindToObject("Adaxes://%member%")
$searcher.Criteria = $criteria
$searcher.SearchScope = "ADS_SCOPE_BASE"
$searcher.PageSize = 500
$searcher.AttributeScopeQuery = "memberOf"

try
{
    # Execute search
    $searchIterator = $searcher.ExecuteSearch()
    $searchResults = $searchIterator.FetchAll()

    if ($searchResults.Length -eq 0)
    {
        return
    }

    foreach ($searchResult in $searchResults)
    {
        $group = $Context.BindToObjectBySearchResult($searchResult)
        $group.Remove("Adaxes://%member%")
    }
}
finally
{
    # Release resources
    if ($searchIterator){ $searchIterator.Dispose() }
}