Delting groups on user

Question

Hello! We doing some changes to our company this days, and we need to delete and add a lot of groups on the users. I was going to use this script to remove all access groups on the user (Greate to have a log, if the user is missing some access, we can easily see what access he had)

$filePath = "C:\Reports\Useradm\Disabledusers\%username%.txt" # TODO: modify me

# Get all groups user is a direct member of
$groupGuids = $Context.TargetObject.GetEx("adm-DirectMemberOfGuid")

# Get the Primary Group ID
$primaryGroupId = $Context.TargetObject.Get("primaryGroupID")

# Create a plain text report
$report = New-Object "System.Text.StringBuilder"
$report.Append("The user was removed from the following groups:")

foreach ($groupGuidBytes in $groupGuids)
{
    # Bind to the group
    $groupGuid = New-Object "System.Guid" (,$groupGuidBytes)
    $groupGuid = $groupGuid.ToString("B")
    $groupPath = "Adaxes://<GUID=$groupGuid>"
    $group = $Context.BindToObject($groupPath)

    # Skip the group if it is the user's Primary Group
    if ($group.Get("primaryGroupToken") -eq $primaryGroupId)
    {
        continue
    }

    # Remove user from the group
    $group.Remove($Context.TargetObject.AdsPath)

    # Add the group to the report
    $report.AppendLine()
    $report.Append($group.Get("name"))
}

# Create a new text
$file = New-Item -Path $filePath -ItemType File

# Save the report to the file
Add-Content $file $report.ToString()

My Problem. We have a system that only syncs every 24 hour for some reason, so we cant remove the groups that gives access to this system. I am having problems implementing a do not delete variable in this script for other then the primary group sadly, is this something you guys could help me solve?

And a bonus question :) What is the best way of deleting and adding new groups true Adaxes? I am now (before moving user) removing all groups and then (after moved) it will add all groups based on Location, title, department and Division.
I see some add access based on templates users(Is this only how you are used to do things, or is there a best practice in Adaxes?)

Thanks for any help :)
Best regards
Tomada

Answer 1

Hello,

I am having problems implementing a do not delete variable in this script for other then the primary group sadly, is this something you guys could help me solve?

Sure, find the updated script below. In the script, the $groupNamesToSkip variable specifies an array of groups from which users must not be removed. Each group in the array is identified by its sAMAccountName.

$filePath = "C:\Reports\Useradm\Disabledusers\%username%.txt" # TODO: modify me
$groupNamesToSkip = @("MyGroup1", "MyGroup2") # TODO: modify me

# Get all groups user is a direct member of
$groupGuids = $Context.TargetObject.GetEx("adm-DirectMemberOfGuid")

# Get the Primary Group ID
$primaryGroupId = $Context.TargetObject.Get("primaryGroupID")

# Create a plain text report
$report = New-Object "System.Text.StringBuilder"
$report.Append("The user was removed from the following groups:")

$groupsToSkip = New-Object "System.Collections.Generic.HashSet[System.String]"
$groupNamesToSkip | %%{$groupsToSkip.Add($_)}
foreach ($groupGuidBytes in $groupGuids)
{
    # Bind to the group
    $groupGuid = New-Object "System.Guid" (,$groupGuidBytes)
    $groupGuid = $groupGuid.ToString("B")
    $groupPath = "Adaxes://<GUID=$groupGuid>"
    $group = $Context.BindToObject($groupPath)

    # Skip the group if it is the user's Primary Group
    if ($group.Get("primaryGroupToken") -eq $primaryGroupId)
    {
        continue
    }
    # Skip special groups
    if ($groupsToSkip.Contains($group.Get("sAMAccountName")))
    {
        continue
    }

    # Remove user from the group
    $group.Remove($Context.TargetObject.AdsPath)

    # Add the group to the report
    $report.AppendLine()
    $report.Append($group.Get("name"))
}

# Create a new text
$file = New-Item -Path $filePath -ItemType File

# Save the report to the file
Add-Content $file $report.ToString()

Is this only how you are used to do things, or is there a best practice in Adaxes?

Your solution with two Business Rules is absolutely fine, you do not need to change anything.

As an alternative, you can use a single script to add and remove users from groups in a Business Rule triggering After Moving a User. In this case, the rule triggering Before Moving a User will not be required.

Comments

Thanks so much for the quick reply. This works like a charm when you specify the group, but this application has over 50 groups, so i tried wild carding it, but that did not work, it removes the group anyways.
Am i doing something wrong, or is this not possible?

Groups: ApplicationName-DivisionName1, ApplicationName-DivisionName2, ApplicationName-DivisionName3, and so on.

I was hopeing it would work something like this :)

$groupNamesToSkip = @("ApplicationName-*") # TODO: modify me

---

Hello,

Yes, it is possible, but requires changes to the script. We have updated the script to meet your needs, find it below.

$filePath = "C:\Reports\Useradm\Disabledusers\%username%.txt" # TODO: modify me
$groupNamesToSkip = @("MyGroup1", "MyGroup2", "ApplicationName-*") # TODO: modify me

function SkipGroup($patterns, $sAMAccountName)
{
    foreach ($pattern in $patterns)
    {
        if ($sAMAccountName -like $pattern)
        {
            return $True
        }
    }

    return $False
}

# Get all groups user is a direct member of
$groupGuids = $Context.TargetObject.GetEx("adm-DirectMemberOfGuid")

# Get the Primary Group ID
$primaryGroupId = $Context.TargetObject.Get("primaryGroupID")

# Create a plain text report
$report = New-Object "System.Text.StringBuilder"
$report.Append("The user was removed from the following groups:")

foreach ($groupGuidBytes in $groupGuids)
{
    # Bind to the group
    $groupGuid = New-Object "System.Guid" (,$groupGuidBytes)
    $groupGuid = $groupGuid.ToString("B")
    $groupPath = "Adaxes://<GUID=$groupGuid>"
    $group = $Context.BindToObject($groupPath)

    # Skip the group if it is the user's Primary Group
    if ($group.Get("primaryGroupToken") -eq $primaryGroupId)
    {
        continue
    }
    # Skip special groups
    $sAMAccountName = $group.Get("sAMAccountName")
    if (SkipGroup $groupNamesToSkip $sAMAccountName)
    {
        continue
    }

    # Remove user from the group
    $group.Remove($Context.TargetObject.AdsPath)

    # Add the group to the report
    $report.AppendLine()
    $report.Append($group.Get("name"))
}

# Create a new text
$file = New-Item -Path $filePath -ItemType File

# Save the report to the file
Add-Content $file $report.ToString()

---

Wow Create! Thanks again!
With support like this, I start to believe world peace is possible! :D ;)

---

Hello,

Thank you for your good words! We do appreciate it a lot.:)