Group membership

Question

We are looking for a way to (after creating account) check the number of groups associated with a user account and send an email if that number is 1 or less. We would like to use this as a check and balance to creating user accounts that may not be setup properly.

Answer 1

Hello,

Have a look at the following script from our repository: http://www.adaxes.com/script-repository ... r-s407.htm. If you have issues updating the script to meet your needs, we will help you.

Comments

The Activity Scope shows nothing. I included the text as it appears in our script.

$to = "eca@aspendental.com" # TODO: modify me
$subject = "Adaxes Alert - group membership" # TODO: modify me
$reportHeader = "<b>Group membership</b><br/><br/>" # TODO: modify me
$reportFooter = "<hr /><p><i>Please do not reply to this e-mail, it has been sent to you for notification purposes only.</i></p>" # TODO: modify me

function SearchObjects($filter, $properties)
{
    $searcher = $Context.BindToObject("Adaxes://rootDSE")
    $searcher.SearchFilter = $filter
    $searcher.SearchScope = "ADS_SCOPE_SUBTREE"
    $searcher.PageSize = 500
    $searcher.ReferralChasing = "ADS_CHASE_REFERRALS_NEVER"
    $searcher.SetPropertiesToLoad($properties)
    $searcher.VirtualRoot = $True

    try
    {
        $searchResultIterator = $searcher.ExecuteSearch()
        $searchResults = $searchResultIterator.FetchAll()

        return ,$searchResults
    }
    finally
    {
        # Release resources
        if ($searchResultIterator){ $searchResultIterator.Dispose() }
    }
}

# Search users
$searchResults = SearchObjects "(sAMAccountType=805306368)" @("memberOf", "cn", "employeeID")

# Build report
$records = New-Object "System.Text.StringBuilder"
foreach ($searchResult in $searchResults)
{
    # Check user groups
    $values = $searchResult.Properties["memberOf"].Values

    if ($values.Count -gt 2)
    {
        continue
    }

    # Add user to report
    [void]$records.Append("<tr>")
    [void]$records.Append("<td>")
    [void]$records.Append($searchResult.Properties["cn"].Value)
    [void]$records.Append("</td>")
    [void]$records.Append("<td>")
    [void]$records.Append($searchResult.Properties["employeeID"].Value)
    [void]$records.Append("</td>")
    [void]$records.Append("</tr>")
}

# Build html
$html = New-Object "System.Text.StringBuilder"
[void]$html.Append($reportHeader)
if ($records.Length -eq 0)
{
    [void]$html.Append("<b>Users not found</b>")
}
else
{
    [void]$html.Append("<table border=""1"">")
    [void]$html.Append("<tr><th>Full Name</th><th>Employee ID</th></tr>")
    [void]$html.Append($records.ToString())
    [void]$html.Append("</table>")
}
[void]$html.Append($reportFooter)

# Send mail
$Context.SendMail($to, $subject, $NULL, $html.ToString())

---

Hello,

As we can see, you have added the If located under condition to the Scheduled Task. Domains are not located under any OUs, thus the task does not get executed. Remove the condition and try running the script again.

If you need to include only users from a specific OU into the report, we will update the script for you.

---

Yes we would want only the OU listed in the screenshot to be searched.

---

Hello,

Thank you for clarifying. You need to create a Scheduled Task configured for Organizational Unit Object type. No conditions need be added to the task. To create the Scheduled Task:

1. Launch Adaxes Administration Console.

2. Right-click your Adaxes service node, navigate to New and click Scheduled Task.
   

3. On step 3 of Create Scheduled Task wizard select Organizational-Unit Object type and click Next.
   

4. Click Add Action and select Run a program or Powershell script.

5. Enter a short description and paste the script below into the Script field. Do not change any lines in the script that do not have the TODO: Modify me comment.

    $to = "recipient@domain.com" # TODO: modify me
    $subject = "Group membership" # TODO: modify me
    $reportHeader = "<b>Group membership</b><br/><br/>" # TODO: modify me
    $reportFooter = "<hr /><p><i>Please do not reply to this e-mail, it has been sent to you for notification purposes only.</i></p>" # TODO: modify me
   
    function SearchObjects($filter, $properties)
    {
        $searcher = $Context.TargetObject
        $searcher.SearchFilter = $filter
        $searcher.SearchScope = "ADS_SCOPE_SUBTREE"
        $searcher.PageSize = 500
        $searcher.ReferralChasing = "ADS_CHASE_REFERRALS_NEVER"
        $searcher.SetPropertiesToLoad($properties)
   
        try
        {
            $searchResultIterator = $searcher.ExecuteSearch()
            $searchResults = $searchResultIterator.FetchAll()
   
            return ,$searchResults
        }
        finally
        {
            # Release resources
            if ($searchResultIterator){ $searchResultIterator.Dispose() }
        }
    }
   
    # Search users
    $searchResults = SearchObjects "(sAMAccountType=805306368)" @("memberOf", "cn", "employeeID")
   
    # Build report
    $records = New-Object "System.Text.StringBuilder"
    foreach ($searchResult in $searchResults)
    {
        # Check user groups
        $values = $searchResult.Properties["memberOf"].Values
   
        if ($values.Count -gt 1)
        {
            continue
        }
   
        # Add user to report
        [void]$records.Append("<tr>")
        [void]$records.Append("<td>")
        [void]$records.Append($searchResult.Properties["cn"].Value)
        [void]$records.Append("</td>")
        [void]$records.Append("<td>")
        [void]$records.Append($searchResult.Properties["employeeID"].Value)
        [void]$records.Append("</td>")
        [void]$records.Append("</tr>")
    }
   
    # Build html
    $html = New-Object "System.Text.StringBuilder"
    [void]$html.Append($reportHeader)
    if ($records.Length -eq 0)
    {
        [void]$html.Append("<b>Users not found</b>")
    }
    else
    {
        [void]$html.Append("<table border=""1"">")
        [void]$html.Append("<tr><th>Full Name</th><th>Employee ID</th></tr>")
        [void]$html.Append($records.ToString())
        [void]$html.Append("</table>")
    }
    [void]$html.Append($reportFooter)
   
    # Send mail
    $Context.SendMail($to, $subject, $NULL, $html.ToString())

   

6. Click OK and then click Next.

7. Click Add on the Activity Scope page and double-click the User Staging OU.
   

8. Important: Select only This Organizational-Unit checkbox.
   

9. Click OK twice and finish creating the Scheduled Task.

---

Thank you Support2 this worked perfectly.