-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathadgroup_unnested.ps1
148 lines (123 loc) · 6.34 KB
/
adgroup_unnested.ps1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
<#
Title: adgroup_unnested.ps1
Authors: Dean Bunn
Last Edit: 2023-03-30
#>
#Var for Config Settings
$cnfgSettings = $null;
#Check for Settings File
if((Test-Path -Path ./config.json) -eq $true)
{
#Import Json Configuration File
$cnfgSettings = Get-Content -Raw -Path .\config.json | ConvertFrom-Json;
}
else
{
#Create Blank Config Object and Export to Json File
$blnkConfig = new-object PSObject -Property (@{ AD_Parent_Domain="parent.mycollege.edu";
AD_Child_Domain="child.parent.mycollege.edu";
AD_Child_Domain_Path="DC=child,DC=parent,DC=mycollege,DC=edu";
AD_Unnested_Groups=@(@{AD_Unnested_GroupName="Unnested Group1";
Object_GUID="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx";
Nested_Groups=@(@{Nested_Grp_Name="Nested Group 1";
Nested_Grp_GUID="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx";},
@{Nested_Grp_Name="Nested Group 2";
Nested_Grp_GUID="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx";})},
@{AD_Unnested_GroupName="Unnested Group2";
Object_GUID="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx";
Nested_Groups=@(@{Nested_Grp_Name="Nested Group 1";
Nested_Grp_GUID="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx";},
@{Nested_Grp_Name="Nested Group 2";
Nested_Grp_GUID="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx";})}
);
});
#Export Json Config File
$blnkConfig | ConvertTo-Json -Depth 4 | Out-File .\config.json;
#Exit Script
exit;
}
# Go Through Each of the Unnested Groups Listed in the Config file
foreach($cfgADGrp in $cnfgSettings.AD_Unnested_Groups)
{
#Hash Table for Data Source DNs
$htDSDNs = @{};
#Hash Table for Members to Remove from AD Group
$htMTRFG = @{};
#HashTable for Members to Add to AD Group
$htMTATG = @{};
#Pull Current AD Group Membership of the Unnested Group
$crntGrpMembers = Get-ADGroupMember -Identity $cfgADGrp.Object_GUID -Server $cnfgSettings.AD_Child_Domain;
#Load Current Members Into Removals HashTable
foreach($crntGrpMember in $crntGrpMembers)
{
#Check for DN
if([string]::IsNullOrEmpty($crntGrpMember.distinguishedName) -eq $false)
{
$htMTRFG.Add($crntGrpMember.distinguishedName,"1");
}
}
#Load Each Nested Group Members Into Data Source HashTable
foreach($nstGrp in $cfgADGrp.Nested_Groups)
{
#Pull Members of Nested Group in Child Domain
$nstGrpMbrs = Get-ADGroupMember -Identity $nstGrp.Nested_Grp_GUID -Recursive -Server $cnfgSettings.AD_Child_Domain;
foreach($nstMbr in $nstGrpMbrs)
{
#Check for Nested Members DN Before Putting in Data Source HashTable
if($htDSDNs.ContainsKey($nstMbr.distinguishedName) -eq $false)
{
$htDSDNs.Add($nstMbr.distinguishedName,"1");
}
}#End of $nstGrpMbrs Foreach
}#End of $cfgADGrp.Nested_Groups Foreach
#Check Data Source Accounts Before Setting Up Nested Membership Sync
if($htDSDNs.Count -gt 0)
{
#Check Data Source Members
foreach($dsDN in $htDSDNs.Keys)
{
#Don't Remove Existing Members In Data Source Listing
if($htMTRFG.ContainsKey($dsDN) -eq $true)
{
$htMTRFG.Remove($dsDN);
}
else
{
#Add Them to List to Be Added to Group
$htMTATG.Add($dsDN.ToString(),"1");
}
}#End of Data Source Members Add or Remove Checks
}#End of Data Source Accounts Checks
#Check for Members to Remove
if($htMTRFG.Count -gt 0)
{
foreach($mtrfg in $htMTRFG.Keys)
{
#Remove Existing Member. Check for Accounts in Child Domain
if($mtrfg.ToString().ToLower().Contains($cnfgSettings.AD_Child_Domain_Path.ToLower()) -eq $false)
{
Remove-ADGroupMember -Identity $cfgADGrp.Object_GUID -members (Get-ADUser -Identity $mtrfg.ToString() -Server $cnfgSettings.AD_Parent_Domain) -Server $cnfgSettings.AD_Child_Domain -Confirm:$false;
}
else
{
Remove-ADGroupMember -Identity $cfgADGrp.Object_GUID -members (Get-ADUser -Identity $mtrfg.ToString() -Server $cnfgSettings.AD_Child_Domain) -Server $cnfgSettings.AD_Child_Domain -Confirm:$false;
}
}#End of $htMTRFG.Keys Foreach
}#End of Members to Remove
#Check for Members to Add
if($htMTATG.Count -gt 0)
{
foreach($mtatg in $htMTATG.Keys)
{
#Add New Member. Check for Accounts in Child Domain
if($mtatg.ToString().ToLower().Contains($cnfgSettings.AD_Child_Domain_Path.ToLower()) -eq $false)
{
Add-ADGroupMember -Identity $cfgADGrp.Object_GUID -members (Get-ADUser -Identity $mtatg.ToString() -Server $cnfgSettings.AD_Parent_Domain) -Server $cnfgSettings.AD_Child_Domain -Confirm:$false;
}
else
{
Add-ADGroupMember -Identity $cfgADGrp.Object_GUID -members (Get-ADUser -Identity $mtatg.ToString() -Server $cnfgSettings.AD_Child_Domain) -Server $cnfgSettings.AD_Child_Domain -Confirm:$false;
}
}#End of $htMTATG.Keys Foreach
}#End of Members to Add
}#End of $cnfgSettings.AD_Unnested_Groups Foreach