Auto-populate AD OU's

Question

Is there a way to auto-populate AD group membership without specifying a separate condition statement for each group? I was hoping to pass the 'department' value by reference after the user is created and then have the membership assigned to the referenced group accordingly.

Answer 1

Hello,

Yes it is possible using a script. Here is a sample one:

Import-Module Adaxes
# Bind to a group. The distinguished name of the group depends on the Department property of the user.
$myGroup = Get-AdmGroup "CN=%department%,CN=Users,DC=company,DC=com"
# Add the user to the group
Add-AdmGroupMember $myGroup "%distinguishedName%"

To use the script, you need to install the Adaxes PowerShell Module on the computer, where the Adaxes service is running. Adaxes PowerShell Module is installed with the same installation package as used to install Adaxes service.

For more details, please see Automatically Change Group Membership Using Scripts.

Comments

---

Hello Joe,

Probably, the issue is that the conditions of your Business Rule are not met. Can you also post the actions and conditions of your Business Rule?

---

I'm attempting to use this script and receiving the following error:

Cannot validate argument on parameter 'TargetPath'. The argument is null or empty. Supply an argument that is not null or empty and then try the command again.

This is my modified version of the script:

Import-Module Adaxes
$Office = "%Office%"
$departmentMap = # TODO: modify me
@{
"Dallas"="OU=USA-Dallas,OU=Adaxes,DC=mydomain,DC=local";
"London"="OU=GBR-London,OU=Adaxes,DC=mydomain,DC=local";
}
$targetOU = $departmentMap[$Office]
if ($targetOU -eq $NULL)
{
$Context.LogMessage("No target OU specified for Office '$Office'", "Warning")
return
}
Move-AdmObject "%distinguishedName%" $targetOU

---

Michael,

The value reference for the Office property is not %Office%, it is %physicalDeliveryOfficeName% because the LDAP name for this property is physicalDeliveryOfficeName. Here's the script modified to your needs:

Import-Module Adaxes
$Office = "%physicalDeliveryOfficeName%"
if ([System.String]::IsNullOrEmpty($Office))
{
    $Context.LogMessage("The Office property is not specified", "Warning")
    return
}

$departmentMap = # TODO: modify me
@{ 
    "Dallas"="OU=USA-Dallas,OU=Adaxes,DC=mydomain,DC=local";
    "London"="OU=GBR-London,OU=Adaxes,DC=mydomain,DC=local";
}

$targetOU = $departmentMap[$Office]
if ([System.String]::IsNullOrEmpty($targetOU))
{
    $Context.LogMessage("No target OU specified for Office '$Office'", "Warning")
    return
}
Move-AdmObject "%distinguishedName%" $targetOU

We tested the script in our testing environment and it works perfectly. We didn't manage to reproduce the error that you get.

---

Thank you that did the trick!