It should come as no surprise that adherence to naming conventions and good Active Directory (AD) Organizational Unit (OU) structure are things that can make an Enterprise Administrator’s life much easier.
Take, for example, the situation of having a naming convention for group objects in AD that dictates a single-letter suffix of either a “C” (to indicate a group of computer objects) or a “U” (for a group of user objects). In this case, a group might be named something like, “Detroit Application Data U”, or “Chicago Printers Floor2 C”. And with intentions such as these — and human beings being what they are — it’s inevitable that some users will end up in computer groups, and vice versa.
So how to we check for this messiness? With PowerShell, of course…
We create a script that will accept an array of our AD OUs (or group-specific OUs if you’re lucky), loop through them, grab all the groups and the memberships, and do a validation to make sure the members are of the correct class (note that I could fill up pages of the lines of code for this, depending on your specifics; so I’ll just stick with the main conceptual points). Let’s dive into the code snippets!
First, add your OUs into an array, and other variables. Of course, you might not be able to just scrape a level with PowerShell and grab all your OUs… Oh, but you *do* have a perfectly-regulated AD hierarchy, don’t you? Whether it’s perfect or not, AD structure goes a long way here; and my examples show how convenient it is if you have all your groups in a standard ou=GROUPS structure or some predictable way.
$OUs = @("Detroit", "Chicago", "Los Angeles") $MyDomain = "dc=MyDomain,dc=org"
Then you start to loop and grab all the groups in an OU:
foreach ($OU in $OUs)
{
#... skipped a few more lines of code here...
# Here we get the list of our groups for the loop
$OuGroupNames = Get-ADObject -Filter {(ObjectClass -eq "group") -and ((name -like "* U") -or (name -like "* C"))} -SearchBase "ou=Groups,ou=$OU,$MyDomain"
And, now that you have the groups, you can start to evaluate each group like this:
foreach ($OuGroup in $OuGroupNames)
{
#...skip more code.. What are we skipping here? Oh, validations, error-checking, and stuff...
# we need the group name and DN
$OuGroupName = $OuGroup.Name
$OuGroupDn = $OuGroup.DistinguishedName
Now, we can truly check the object membership type!
# If it is a user group...
if ($OuGroupName -like "* U") { $MemberList = Get-ADGroupMember -Identity "$OuGroupName"
# ...it had better be a user... if ($Member.ObjectClass -like "computer")
{
#...or we kick out an error to the report!
And so on. Of course, you’d do the converse of the snippet above for a user-type object in a “C” group. By the way, this can lead to all kinds of other error detection too; in fact, the main reason I couldn’t show all my code is that I ended up adding checks for empty groups, groups with members from external OUs, and so on. Because basically, once you have the group attributes and its membership list in hand, you may as well do some validation while you’re there…
So have fun with it, and see where it leads you… And make sure to drop me a line if you need any help putting the whole thing together.
Tags: get-adgroupmember, group objects, groups, membership, Powershell, script
