We use cookies to improve your experience.
By your continued use of this site you accept such use.
For more details please see our privacy policy and cookies policy.

Script repository

Check extra group membership

February 25, 2021 Views: 888

The script returns true if the target object is a member of any groups except for the predefined ones. The script can be executed in a custom command, business rule or scheduled task via the If PowerShell script returns true condition.

Parameters:

  • $groupDNs- Specifies distinguished names (DNs) of the groups membership in which should be ignored by the script. For information on how to get the DN of a directory object, see Get the DN of a directory object.
Edit Remove
PowerShell
$groupDNs = @("CN=My Group1,OU=Groups,DC=domain,DC=com", "CN=My Group2,OU=Groups,DC=domain,DC=com") # TODO: modify me

$Context.ConditionIsMet = $False

# Get current group membership
$currentGroupGuids = New-Object System.Collections.Generic.Hashset[System.Guid]
$Context.TargetObject.GetEx("adm-DirectMemberOfGuid") | %%{$currentGroupGuids.Add([Guid]$_)}

# Exclude primary group
$primaryGroupId = $Context.TargetObject.Get("primaryGroupID")
$userSid = New-Object Softerra.Adaxes.Adsi.Sid @($Context.TargetObject.Get("objectSid") , 0)
$domainSid = $userSid.AccountDomainSid
$primaryGroupSid = $domainSid.ToString() + "-" + $primaryGroupId
$primaryGroup = $Context.BindToObject("Adaxes://<SID=$primaryGroupSid>")
$primaryGroupGuid = [Guid]$primaryGroup.Get("objectGuid")
$currentGroupGuids.Remove($primaryGroupGuid)

if ($currentGroupGuids.Count -eq 0)
{
    return
}

if ($groupDNs.Length -lt $currentGroupGuids.Count)
{
    $Context.ConditionIsMet = $True
    return
}

# Exclude predefined groups
$groupGuidsToCheck = New-Object System.Collections.Generic.Hashset[System.Guid]
foreach ($groupDN in $groupDNs)
{
    $group = $Context.BindToObjectByDN($groupDN)
    $guid = [Guid]$group.Get("objectGuid")
    $currentGroupGuids.Remove($guid)
}

if ($currentGroupGuids.Count -ne 0)
{
    $Context.ConditionIsMet = $True
}
Comments 0
Leave a comment
Loading...

Got questions?

Support Questions & Answers