Powershell Script to query Active Directory

Question

I am trying to query all users in multiple OUs of the same name. Get the SamAccountName attribute and then check for a file at a specific location with that name.

Here is what I have so far:

$ous = Get-ADOrganizationalUnit -Filter "Name -eq 'Admin-User-Accounts'" 
$ous | ForEach-Object {
    $AccountName = Get-ADUser -Filter * -SearchBase $_.DistinguishedName |
                   Select SamAccountName
    Test-Path "\\domain.net\SYSVOL\domain.net\IA\$AccountName.pdf"
}

If a file is not found. I want to add the user to a group, however here is the kicker. The account has to be added to the non-compliance group for the organization that the account belongs to.

I.E an admin account found under:

OU=Admin-User-Accounts,OU=Administration,OU=ORG1,OU=ORGS,DC=domain,DC=net

would be added to the group named 'ORG1 IA - Non-Compliant Users' located under:

OU=Groups,OU=ORG1,OU=Information Assurance,OU=ORGS,DC=domain,DC=net

Well, it seems I do not have enough skill to write the code to get this to work. — Jacob Pagano
Putting users into the groups will be impossible with the information given. You need a list, naming scheme, mapping, or some way of tagging which groups users should be assigned unless there is only one group in the respective OU. — AdminOfThings

postanote postanote · Accepted Answer · 2019-03-14T08:48:42

Well your post is a bit confusing, and no way to really validate because I have nothing setup like this.

Yet, querying for users in all OU or the enterprise is a common everyday thing.

However, an OU name, just like any other AD object name, must be unique. So, querying for the same OU name is not a thing, in a single AD forest / domain. If you meant querying every OU for the same username, then alrighty then.

By stepping thru how you are explanation for your use case, that you have laid out.

(though maybe you want to edit your post to make it's more clear, well to me anyway...)

Using pseudo code, then trying to map that out... and with no real way to determine what you mean by several things in your post/sample. So, the below is a rough first example of how I'd do approach this... again this is untested, so, I leave that homework to you.

# query all users in multiple OUs
(Get-ADOrganizationalUnit -Filter *).DistinguishedName |
ForEach{
    # Collect all members of the current OU
    $AccountNames = Get-ADUser -SearchBase $PSItem -Filter *

    # Process each member in the current OU collection
    ForEach($AccountName in $AccountNames)
    {
        "Processing $($AccountName.SamAccoutnName)`n"

        # Initialize properties needed for processing
        $UserOrg = $AccountName.DistinguishedName.split(",")[1]
        $MemberCheckOU = "OU=Admin-User-Accounts,OU=Administration,OU=ORG1,OU=$UserOrg,DC=domain,DC=net"
        $NonCompliantOU = "OU=Groups,OU=ORG1,OU=Information Assurance,OU=$UserOrg,DC=domain,DC=net"

        # Validate user file existence for the current user
        If(-Not (Test-Path -LiteralPath "\\domain.net\SYSVOL\domain.net\IA\$($AccountName.SamAccoutnName).pdf)"))
        {
            # if no file Process the user groupmebership modification
            "Processing $($AccountName.SamAccoutnName)"

            # Notify that the file was not found and processing is required
            Write-Warning -Message "$($($AccountName.SamAccoutnName).pdf) not found. Process group modify actions"       

            # If the current user is in the MemberCheckOU, add to the NonCompliantOU
            If(Get-ADPrincipalGroupMembership -Identity $($AccountName.SamAccoutnName) | Where-Object -Property DistinguishedName -Match $MemberCheckOU )
            { Add-ADGroupMember -Identity $NonCompliantOU -Members $($AccountName.SamAccoutnName) }
            Else
            {
                # Do something else
            }
        }
        Else
        { 
          # Notify that the file was found and no processing required
          Write-Host "$($AccountName.pdf) found. No further actions taken" -ForegroundColor Green }
    }
}

Powershell Script to query Active Directory

3 Answers