If user in group return true

Question

Hello everyone,

I have the following code with which I want to check whether the user is in one of the 7 groups and if so it should return true. For this I have the condition in a business rule, if powerschell returns true, a mail should be sent. However, I never receive a mail although the user is in one of those groups? Do I have an error in the script?

Thank you very much!

# Define the username and the list of groups
$userName = "%username%"
$groupList = @( "grp_1",
                "grp_2",
                "grp_3",
                "grp_4",
                "grp_5",
                "grp_6",
                "grp_7")

# Initialize the variable to store the result
$Context.ConditionIsMet = $False;

# Check each group to see if the user is a member
foreach ($group in $groupList) {
    # Get the members of the group
    $groupMembers = Get-ADGroupMember -Identity $group -ErrorAction SilentlyContinue | Select -ExpandProperty SamAccountName

    # Check if the username is in the group's member list
    if ($userName -in $groupMembers) {
        $Context.ConditionIsMet = $True;
        break; # Stop the loop since the user was found in a group
    }
}

# Return the result
return $Context.ConditionIsMet;

Answer 1

Hello,

First of all, there is no need to use scripts. You can just use the dedicated condition. For example: If you still prefer using a script, you can use the below one. In the script, the $groupDNs variable specifies distinguished names (DNs) of the groups to check. For information on how to get an object DN, see https://adaxes.com/sdk/HowDoI.GetDnOfObject.

$groupDNs = @("CN=gr_1,OU=Groups,DC=compay,DC=com", "CN=gr_2,OU=Groups,DC=compay,DC=com", "CN=gr_3,OU=Groups,DC=compay,DC=com", "CN=gr_4,OU=Groups,DC=compay,DC=com")

$Context.ConditionIsMet = $False

foreach ($groupDN in $groupDNs)
{
    $group = $Context.BindToObjectByDN($groupDN)

    if($group.IsMember($Context.TargetObject.AdsPath))
    {
        $Context.ConditionIsMet = $True
        return
    }
}

Comments

Hello, yes I'm going to use the script, because we check a lot of groups. So with the script it takes less clics.

But I testet the script, and the answer is send when the user is not member of these groups... How can I adapt this error?

thx

---

Hello,

Most probably, there is something more complex in your case as the script works exactly as intended when the target object and the groups are in the same domain. Try using Return true if the target object is a member of any of the groups from the following article: https://www.adaxes.com/script-repository/check-whether-the-target-object-is-a-member-of-multiple-groups-s294.htm.