Unable to get groupCategory attribute of AD group

Question

Hi, I am making business rule which calls powershell script and inside the script I need to check whether account which is added to group is security group. I am using Get-AdmGroup cmdlet for this but it doesn't return this attribute at all. Strange is, that when I am calling exactly the same command from powershell session, it works without problem. Getting other attributes is without problem also.

Command

$group = Get-AdmObject -Properties * -Filter "distinguishedname -eq "%member%"" $Context.LogMessage(("3" + $group.GroupCategory), "Information")

returns nothing, but

$Context.LogMessage(("1" + $group.ObjectClass), "Information") $Context.LogMessage(("2" + $group.ObjectGUID), "Information") $Context.LogMessage(("4" + $group.ProtectedFromAccidentalDeletion), "Information")

is returning correct information without any problem, so it seems that just GroupCategory is missing/empty.

In standalone powershell console, the same command return, that group type is security

So what am I doing wrong?

Answer 1

Hello,

In your Business Rule you are using the Get-AdmObject cmdlet which only retrieves default property values that do not include the GroupCategory property. While in Windows PowerShell, you are using the Get-AdmGroup cmdlet, which fetches group specific properties. Also, it is recommended to specify the -AdaxesService and the -Server parameters when using Adaxes cmdlets. Finally, your command should look like the following:

$group = Get-AdmGroup -Properties "GroupCategory" -Filter {distinguishedname -eq "%member%"} -AdaxesService localhost -Server "myserver.domain.com"

Additionally, it is not recommended to use the %member% value reference in LDAP filters as it does not always resolve into the distinguished name (DN) of the member added or removed from a group. We recommend you to use the value reference to bind to the group that is added as member and then get its properties as in the below example.

# Bind to member
$group = $Context.BindToObject("Adaxes://%member%")

# Output group category
$groupType = $group.Get("groupType")
if ($groupType -band 0x80000000)
{
    $Context.LogMessage("3 + Security", "Information")
}
else
{
    $Context.LogMessage("3 + Distribution", "Information")
}