Remove Member Of

Question

Hi Team. 
 
 I am just looking for suggestions on overcoming a minor issue. 
 Let's say I have the following. 
 UserA and UserA is a member of GroupA 
 We have a secure T0 area in our AD, and we have not allowed anyone in GroupA to change the accounts that are in T0. However, because UserA can add members to groups outside of T0, they also seem to be able to add T0 accounts to the groups. 
 Is there a way to deny Add on Member of for accounts in a certain OU if the person making the change is in GroupA 
 Thanks in advance

Terrance.Crombie · Answer

Craig, 
 A few notes on this script module: 
 On line 1, your function name (onPreModify) is one of the reserved names for Event Handlers used in a Policy Script. If you intend to use this in a Workflow, then you should be using a custom function name to ensure that there is no confusion and to ensure that this script doesn't wreak havoc with your policies if it happens to be accidentally included in a policy. 
 Line 3 and 4 are not needed. When running a script module within Active Roles, when creating the PowerShell runspace, the Active Roles Administration Service will execute 'Connect-QADService -Proxy -Service localhost' 
 Line 13 is not needed. Active Roles Administration Service will execute 'Import-Module ActiveRolesManagementShell' when creating the PowerShell runspace. 
 Line 19 is not very efficient. You're returning the entire Managed Unit and then looping through each object using the Where-Object. This will work, but if the Managed Unit grows significantly, performance will be terrible. Instead, I'd use the -LdapFilter parameter with something like '(samAccountName=$Username)' to perform a more efficient search. 
 Other than these items, the logic of the script seems to be good. The biggest thing that you're missing would be variable checks. After your variable assignment you're assuming that everything is fine and you are proceeding to use the variable. Scripting best-practice would be to not assume anything. If you need to retrieve or construct a variable, make sure that is has a value before attempting to use it.

Remove Member Of

Top Replies