Trigger Alert/Warning message when accounts are added to AD Groups in specific OU

There are a couple of ways to approach this (and you can use all if you want):

You could establish a group membership policy (using the built-in group membership autoprovisioning) that prevents accounts from being added to the restricted groups.  A simple example of such a policy would say that if a user has the word "Admin" in their title, that they must not be a member of Group A, Group B and Group C.  Implemented this way, you would see a message appear in a red bar atop the web interface if someone attempted an "illegal" group membership change like this.

Another approach that would provide a different kind of notification (via e-mail) would be an "change workflow".  In the start conditions of the workflow, you could tell the workflow to watch for changes to groups in your "Restricted Groups" OU or a list of groups.  When triggered, the workflow could send a notification that an illegal change has been made AND remove the user from the group they should not be in.

Of course, the best place to start all of this would be to restrict who can add users to your sensitive groups in the first place by placing them in a specific OU and then delegating membership changes only to a small subset of delegated admins.  You could also also add an e-mail approval step for each group membership change - also initiated by a change workflow that watches for changes to the sensitive groups.

Hope this helps.

Thank you Johnny for taking your time and for responding.. I am gonna try using  my local instance before I try this in our work

Regards

Shyam

Thank you Johnny for taking your time and for responding.. I am gonna try using  my local instance before I try this in our work

Regards

Shyam