Powershell CSV User / Group Sync to AD Best Practices?

[rypowell]

Hi All

 

I'm looking to write a few Powershell scripts for sychronising class and staff groups from SIMS reports exported as CSV into AD security groups.

 

I have examples that seem to work well and are currently in use, however I'm wondering what the best practices are in this area. Especially around performance and identifying changes in group membership.

 

Currently I create a list (array) of all users that should be in the groups based on CSV content, I then create a list of users that are currently in the AD groups and then perform a third pass to add users into the AD groups that aren't in there already. Although this works well I feel the solution isn't very elegant and could have performance issues once groups begin to reach large numbers of members.

 

I'm wondering whether it's better to just delete all members from each AD group when the script runs and to then just add people back in if they're in the CSV. This eliminates the need of doing multiples passes of the data set as well as scraps needing to compare current and perspective group members.

 

Would you recommend either of these approaches or is there another (more standardised) method of maintaining group membership based on a CSV export I haven't considered?

 

Thanks in advance

 

Ryan

[pcstru]

I'm wondering whether it's better to just delete all members from each AD group when the script runs and to then just add people back in if they're in the CSV. This eliminates the need of doing multiples passes of the data set as well as scraps needing to compare current and perspective group members.

I think the problem with this is how the information propagates from AD to client devices. AD will likely have an internal GUID associated with the object that is the primary key, so every time you have any membership change, you will be redistributing all the info as if it is fresh. Other associations made later might also tie in to an underlying object GUID rather than the group name. So personally I favour the heavier multi-pass processing necessary to neatly update memberships, rather than just delete everything and build it as it should be now.

[rypowell]

Thanks for the reply.

 

That was roughly my thinking. I don't know enough about the internal workings of AD to be sure what would be affected and in what way if the group was cleared and fully repopulated at each run.

[Sibrows]

Care to share any of your PowerShell scripts?

[rypowell]

Yeah of course. Not got them with me on my home laptop but will post an example one tomorrow for you.

 

Been working on other scripts to push AD user thumbnails into Office 365 and also staff lists into faculty/subject distribution groups.

 

The office 365 ones are incredibly slow so I only run these on occasion if I notice kids have managed to get around the restrictions on uploading their own pictures to their profiles.

 

I'll put some examples (or links to them) on in the morning for you.

[Ephelyon]

OP, I've done this (evidence here). The class/set lists, not the user thumbnails. However, my method relies on having an AD field populated with the student's UPN number. We already had this anyway as part of the synchronisation with our Parental Portal, but it can be scripted such that you'll end up with about 9 in 10 done automatically (based on our setup at least) with only a few to do manually, then everything else sorts itself out.

[pcstru]

Care to share any of your PowerShell scripts?

If it is of any interest : my group creation script can be found Here (last post not the first).

Edited December 4, 2015 by pcstru

[rypowell]

Hi all ( @Sibrows especially)

 

Link to an example PS script is here: http://1drv.ms/1NwVRc3

 

This scripts takes a CSV from SIMS (using command reporter) of teachers and the pastoral groups they belong to and their role. For example Year 7 tutor or Year 8 manager.

 

The PS script has a table of year groups and roles that we're interested in and maps these to the name of an AD group to populate. Hopefully it's relatively self explanatory but feel free to ask any questions.

 

Ryan