This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

ARS PowerShell script to "Move" users from one group to another.

I have a .csv with 2 columns. Column 1 is called SourceGroup with a list of groups, and the other is DestinationGroup with a different list. I have a script I am trying to use that will Add the users from SourceGroup to the DestinationGroup, after the user will be removed from the source group. The error I am receiving is that they are already a member of the DestinationGroup. The issue is they are an indirect member, and I want to make them active members. Is there something I can add to my script to have it not check for indirect memberships? Here is the script I am using. I was hoping to not need to use the AD native tool as that would require me escalate up to Domain admin.

 clear
$admin = read-host "Enter username(domain\username)"
$pw = read-host "Enter password" -AsSecureString

$LogFile = "H:\ticketstuff\success.txt"
$LogFile2 = "H:\ticketstuff\failed.txt"

connect-qadService -ConnectionAccount $admin -ConnectionPassword $pw

$list = import-csv “H:\ticketstuff\listtest.csv"


foreach( $Group in $List ){
    $Members = Get-qadGroupMember $Group.SourceGroup | select UserPrincipalName
    $Member = $Members.UserPrincipalName 
    $S = Get-QADGroup $Group.SourceGroup | Select-Object -ExpandProperty name
    $D = Get-QADGroup $Group.DestinationGroup | Select-Object -ExpandProperty name
    foreach ($User in $Member){
    Try
        {
        add-qadgroupmember -identity $Group.DestinationGroup -member $User | Where{$_.objectClass -eq 'User'} -ErrorAction Stop
        "User $User added to group $S" | Add-Content -Path $LogFile
        remove-qadgroupmember -identity $Group.SourceGroup -member $User | Where{$_.objectClass -eq 'User'}
        "User $User removed from group $D" | Add-Content -Path $LogFile
        }
    catch
          {
	        "Error $User already in group $D" | Add-Content -Path $LogFile2
          }
     }
}
  
Disconnect-QADService 

Parents
  • I am not quite sure what the issue is, but I have just tested in my lab and I am not seeing any errors when adding a Group Member into a Group that it is already an indirect member of.

    The user is simply added as a direct member. I just used the cmdlet directly from your script by itself, connected to Active Roles:

    add-qadgroupmember -identity $Group.DestinationGroup -member $User

    You're performing both operations in the same TRY and you only have one CATCH. Perhaps you should split them up to see if you can isolate the error.

Reply
  • I am not quite sure what the issue is, but I have just tested in my lab and I am not seeing any errors when adding a Group Member into a Group that it is already an indirect member of.

    The user is simply added as a direct member. I just used the cmdlet directly from your script by itself, connected to Active Roles:

    add-qadgroupmember -identity $Group.DestinationGroup -member $User

    You're performing both operations in the same TRY and you only have one CATCH. Perhaps you should split them up to see if you can isolate the error.

Children
No Data