Copy all groups of a user, create a new group add the groups copied in this group

Question

How can I create a script that does these things

For internal audit. objective

Even removing all groups of a disconnected user, we will still know which groups the user was in because the (audit)-sAMAccountName-access group that contains all other groups still exist identifying the user by sAMAccountName

1. copy all groups in memberOf user (user)-sAMAccountName

2. create new group (audit)-sAMAccountName-access add all groups copied in memberOf

3. in the created group (audit)-sAMAccountName-access add the (user)-sAMAccountName in members

Comments

Hello Alan,

For us to help you with the script, please, specify the following:

• Do we understand correctly that the target user should be removed from all the current groups?
• What should the type and scope of the new group created by the script be?
• What should be done in case if a group with the name following your template already exists?
• How should the location for the new group be determined? Will it be predefined in the script?

Any additional details will be much appreciated.

---

Do we understand correctly that the target user should be removed from all the current groups?

• The revocation script for all groups is already in production and working.

What should the type and scope of the new group created by the script be?

• Security Group Type Scope

What should be done in case if a group with the name following your template already exists?

• if there is the same name, just add the target user's groups.

How should the location for the new group be determined? Will it be predefined in the script?

• Yes, all groups created by the script, or already existing, must be in one, OR predefined in the script.

---

Hello Alan,

The revocation script for all groups is already in production and working.

Please, post the script here or send it to us (support@adaxes.com) in TXT format. The best way to achieve the desired behaviour is to update the existing script.

Yes, all groups created by the script, or already existing, must be in one, OR predefined in the script

Sorry for the confusion, but we need to know how the location for new group should be determined. In which OU should it be? Will the OU always be the same?

---

Script

$groupGuidsBytes = $Context.TargetObject.GetEx("adm-DirectMemberOfGuid")
$primaryGroupId =    $Context.TargetObject.Get("primaryGroupID")
foreach ($guidBytes in $groupGuidsBytes)
{

$groupGuid = [Guid]$guidBytes
$groupPath = "Adaxes://<GUID=$groupGuid>"
$group = $Context.BindToObject($groupPath)
if ($group.Get("primaryGroupToken") -eq $primaryGroupId)
{
    continue
}
$group.Remove($Context.TargetObject.AdsPath)
}

Or location of created groups

OU=ACCESS-AUDIT,OU=GROUP,OU=DEV,OU=CONTOSO,DC=company,DC=internal

DC TREE

• DC
  • CONTOSO
    • DEV
      • GROUP
        • ACCESS-AUDIT

Answer 1

Hello Alan,

Thank you for the provided details. Please, find the updated script below. In the script:

• $groupNameTemplate – Specifies a template for the group all user groups will be added to. You can use value references (e.g. %sAMAccountName%) in the template.
• $ouDN – Specifies the distinguished name (DN) of the OU where the group for user groups will be created. For information on how to get an object DN, see https://adaxes.com/sdk/HowDoI.GetDnOfObject.

$groupNameTemplate = "(audit)-%sAMAccountName%" # TODO: modify me
$ouDN = "OU=ACCESS-AUDIT,OU=GROUP,OU=DEV,OU=CONTOSO,DC=company,DC=internal" # TODO: modify me

# Bind to the group
$groupDN = "CN=" + $groupNameTemplate + "," + $ouDN
try
{
    $auditGroup = $Context.BindToObjectByDN($groupDN)
}
catch
{
    # Bind to the group OU
    $groupOU = $Context.BindToObjectByDN($ouDN)

    # Create group
    [Softerra.Adaxes.Interop.Adsi.ADS_GROUP_TYPE_ENUM]$groupType =
        "ADS_GROUP_TYPE_GLOBAL_GROUP, ADS_GROUP_TYPE_SECURITY_ENABLED"

    $auditGroup = $groupOU.Create("group","CN=$groupNameTemplate")
    $auditGroup.Put("groupType", [Int32]$groupType)
    $auditGroup.SetInfo()
}

$groupGuidsBytes = $Context.TargetObject.GetEx("adm-DirectMemberOfGuid")
$primaryGroupId =    $Context.TargetObject.Get("primaryGroupID")

foreach ($guidBytes in $groupGuidsBytes)
{
    $groupGuid = [Guid]$guidBytes
    $groupPath = "Adaxes://<GUID=$groupGuid>"
    $group = $Context.BindToObject($groupPath)

    if ($group.Get("primaryGroupToken") -eq $primaryGroupId)
    {
        continue
    }
    $group.Remove($Context.TargetObject.AdsPath)
    $auditGroup.Add($groupPath)
}