Hello,
Sure. Here you are.
The following script removes a user from all groups they are a member of and saves the GUIDs of the groups to Adaxes custom attribute CustomAttributeBinary1:
# Get GUIDs of the groups the user is a member of
$sourceGroupGuids = $Context.TargetObject.GetEx("adm-DirectMemberOfGuid")
# Get the ID of the user's primary group
$primaryGroupId = $Context.TargetObject.Get("primaryGroupID")
# Build group list
$totalBytes = $sourceGroupGuids.Count * 16
$result = New-Object 'System.Collections.Generic.List[System.Byte]' $totalBytes
foreach ($groupGuidBytes in $sourceGroupGuids)
{
# Bind to the group
$guid = [Guid]$groupGuidBytes
$groupPath = "Adaxes://<GUID=$guid>"
$group = $Context.BindToObject($groupPath)
# Skip the group if it is the primary group for the user
if ($group.Get("primaryGroupToken") -eq $primaryGroupId)
{
continue
}
$result.AddRange($groupGuidBytes)
# Remove the user from the group
$group.Remove($Context.TargetObject.AdsPath)
}
if ($result.Count -eq 0)
{
return
}
# Save the data to the adm-CustomAttributeBinary1 virtual property of the user
$Context.TargetObject.Put("adm-CustomAttributeBinary1", $result.ToArray())
$Context.TargetObject.SetInfo()
To execute the task when deprovisioning users, you can add the script to the Custom Command that you use for deprovisioning. By default, built-in Custom Command Deprovision is used for this purpose. For information on how to add an action to this Custom Command, see step 5 in the following tutorial: http://www.adaxes.com/tutorials_ActiveD ... ioning.htm. You need to add the Run a program or PowerShell script action and paste the above script in the Script field.
This script re-adds a user to the groups specified in Adaxes custom attribute CustomAttributeBinary1:
# Get group GUIDs
try
{
$groupGuids = $Context.TargetObject.Get("adm-CustomAttributeBinary1")
}
catch
{
$Context.LogMessage("Could not get the GUIDs of the groups the user was a member of before deprovisioning.", "Warning")
return
}
# Calculate the number of groups
$totalBytes = $groupGuids.Length
# Make sure that the total number of bytes is a divisible of 16
$remainder = 0
[System.Math]::DivRem($totalBytes, 16, [ref] $remainder)
if ($remainder -ne 0)
{
$Context.LogMessage("Unexpected data length when reading the GUIDs of the groups the user was a member of before deprovisioning!", "Error")
return
}
$groupsToAdd = New-Object "System.Collections.Generic.HashSet[System.Guid]"
for ($i = 0; $i -lt ($totalBytes / 16); $i++)
{
$bytes = [System.Guid]::Empty.ToByteArray()
[System.Array]::Copy($groupGuids, $i * 16, $bytes, 0, 16)
$guid = [Guid]$bytes
$groupsToAdd.Add($guid)
}
# Get GUIDs of the groups the user is already a member of and remove them from the $groupsToAdd list
$targetGroupGuids = $Context.TargetObject.GetEx("adm-DirectMemberOfGuid")
foreach($targetGroupGuidBytes in $targetGroupGuids)
{
$guid = [Guid]$targetGroupGuidBytes
$groupsToAdd.Remove($guid) | Out-Null
}
# Add the user to the groups in the $groupsToAdd list
foreach($groupGuid in $groupsToAdd)
{
try
{
$group = $Context.BindToObject("Adaxes://<GUID=$groupGuid>")
$group.Add($Context.TargetObject.AdsPath)
}
catch
{
$Context.LogMessage($_.Exception.Message, "Warning")
continue
}
}
# Clear the custom attribute
$Context.TargetObject.Put("adm-CustomAttributeBinary1", $NULL)
$Context.TargetObject.SetInfo()
To be able to restore group memberships of the users whom you want to re-provision, you need to create a Custom Command that can run the script on a user account. For information on how to create Custom Commands, see the following tutorial: http://www.adaxes.com/tutorials_ActiveD ... ommand.htm. Use it as a guide. On step 4, add the Run a program or PowerShell script action and paste the script in the Script field.