Domain Admin temporary access

I built a solution like this for a client where they wanted their admins to "borrow" elevated privilege group memberships.

We added a custom page to AR's self service web site where a user could choose the groups they wanted to be a part of and they would be added to their account with an expiration time using the built-in temporal group membership feature.  The list of groups they were able to choose from was "filtered" by populating an attribute on the "in scope" groups.

The custom page showed users the expiration date and time of their borrowed memberships.

I built a solution like this for a client where they wanted their admins to "borrow" elevated privilege group memberships.

We added a custom page to AR's self service web site where a user could choose the groups they wanted to be a part of and they would be added to their account with an expiration time using the built-in temporal group membership feature.  The list of groups they were able to choose from was "filtered" by populating an attribute on the "in scope" groups.

The custom page showed users the expiration date and time of their borrowed memberships.

That sounds like just what we need, thanks!

Do you know how we can check if a group member has temporary group membership enabled and how long for?

I can get Get-QADGroupMember has a Control argument, but I cannot work out how to use it.

I want to stop people from adding themselves for several days and I want to default membership to 1 hour (which I've found a solution for)

As usual, after posted the question, I found the details in the SDK.

this is the code I've come up with, can't work out if there is a more efficient way of achieving this, would appreciate any feedback.

function Grant-TemporalGroupMembership($Request) {
    $users = $workflow.SavedObjectProperties("AddedMembers").getEx("member")
    $groupDN = $Request.Get("distinguishedName")

    [System.Reflection.Assembly]::LoadWithPartialName("System.DirectoryServices") | Out-Null
    $adsiPath = "EDMS://$($groupDN)//EDS_SEARCHPREF_ATTRIBUTE_QUERY=member//ScheduledLink-GetStartEndTime=1"
    $rootDirectory = New-Object System.DirectoryServices.DirectoryEntry($adsiPath)
    $searcher = New-Object System.DirectoryServices.DirectorySearcher($rootDirectory)
    $searcher.Filter = "(objectClass=*)"
    $properties = @(
        "distinguishedName",
        "edsva-ScheduledLink-EndTime"
    )
    foreach ($p in $properties) {
        $searcher.PropertiesToLoad.Add($p) | Out-Null
    }
    $time = (Get-Date).AddHours(1).ToUniversalTime().ToString("dd MMM yyyy HH:mm")
    $control = @{
        "ScheduledOperation-SetTime" = $time
    }
    $members = $searcher.FindAll()

    foreach ($userDN in $users) {
        # only check admin accounts, leave service accounts etc
        if ($userDN -imatch ".*OU=Accounts,OU=Admin,DC=somewhere,DC=local") {
            $members | Where-Object { 
                (
                    $_.Properties["edsva-scheduledlink-endtime"] -gt (Get-Date).addhours(4) -or
                    $null -eq ($_.Properties["edsva-scheduledlink-endtime"]).Length
                ) -and 
                $_.Properties["distinguishedName"] -eq $userDN
            } | ForEach-Object {
                Remove-QADGroupMember -Identity $groupDN -Member $userDN -Control $control
            }
        }
    }
}