Active Directory Groups

[07jotters]

Hi All,

 

I work at a school where we have the following setup -

 

Users > Students > Year 7 ... and so on

 

What I would like to achieve is so that every student in Year 7 is part of a Year 7 'security group'? and then when they move up to Year 8 they're removed from year 7 and added to Year 8 - Is there any sort of 'Dynamic' groups that I can use in order to achieve this?

 

Many thanks,

James

[synaesthesia]

Not without scripting, but for the very same reason many schools use year of entry instead of year groups so it doesn't ever need to change.

[dapaulio]

Are they security groups? Or are they just distribution groups named as security groups?

If it’s not too much work I would advise changing your structure eg year 7 = 2018intake.

 

For the exact reasons that have become apparent to you now it’s a huge amount of work every year

[MatthewL]

Is the create query based query available still? You can target that at OU's for exactly this purpose.

[smarties11]

Obviously it would be too expensive for just this requirement, but Salamander can do this for you and automatically update as frequently as you wish. It can also provision your users automatically from SIMS, add timetable to their email calendars, set exchange permissions, create and update class distribution lists, create and update 'teachers of X student's distribution lists, set O365 licenses and a million more things. Highly recommended!

[dapaulio]

How about something like this.

I have just whipped this up now and so please test it before running it on your production environment.

You will need to start with the highest year first as you will need to empty a group before users in to it.

Remove members from year13

Year12 --> Year13

Year11 --> Year12

Year10 --> Year11

Year9 --> Year10

Year8 --> Year9

Year7 --> Year8

$YearOld="testusers"
$YearNew="test internet"
$USERS=Get-ADGroupMember -identity $YearOld | select SAMACCOUNTNAME 
Foreach ($USER IN $USERS){
Add-ADGroupMember -Identity $YearNew -Members $USER.SAMACCOUNTNAME
Remove-ADGroupMember -IDENTITY $YearOld -MEMBERS $USER.SAMACCOUNTNAME -confirm:$false
Write-Output "$user moved from $YearOld to $YearNew"
}

[kennysarmy]

Hi All,

 

I work at a school where we have the following setup -

 

Users > Students > Year 7 ... and so on

 

What I would like to achieve is so that every student in Year 7 is part of a Year 7 'security group'? and then when they move up to Year 8 they're removed from year 7 and added to Year 8 - Is there any sort of 'Dynamic' groups that I can use in order to achieve this?

 

Many thanks,

James

 

 

I just do it manually each year - takes no longer than 5 minutes.

 

In AD move all accounts in curriculum.local\Users\Pupils\Left year13 to the Left and Disabled OU

In AD move all accounts in curriculum.local\Users\Pupils\13 to the Left year 13 OU and edit the description field for all accounts to LEFT 13

In AD move all accounts in curriculum.local\Users\Pupils\12 to the 13 OU and edit the description field to the correct year group, edit the Office field: Do this for all remaining year groups 11 to 7.

Remove all students from each year group security group and re-add to the correct one.

[Jaan]

We got tired of having to maintain the year groups and having to think about scripting.

 

We also use the year of intake with the matching Security Group

 

[MartinT]

Yes, we use intake2017 etc. for groups and it makes it a lot easier - change the group permissions (e.g. age-appropriate filtering) rather than the memberships.

[KevinB]

I use shadow groups here for managing workstation group memberships but the principle is the same. This example PS script makes sure that all objects in the "Student Desktops" OU are in the "SG-Student-Desktops" security group and removes those that are no longer in the OU from the group.

 

# Set up the OU
$OU1="OU=Student Desktops,OU=Student,OU=Computers,OU=Managed,DC=yoursite,DC=yourla,DC=sch,DC=uk"
# Set up the Security Group
$ShadowGroup1="CN=SG-Student-Desktops,OU=Workstation Shadow Groups,OU=Security Groups,OU=Managed,DC=yoursite,DC=yourla,DC=sch,DC=uk"

# Remove any group members that are not in $OU1
Get-ADGroupMember –Identity $ShadowGroup1 | Where-Object {$_.distinguishedName –NotMatch $OU1} | ForEach-Object {Remove-ADPrincipalGroupMembership –Identity $_ –MemberOf $ShadowGroup1 –Confirm:$false}
# Add members of $OU1 to $ShadowGroup1
Get-ADComputer –SearchBase $OU1 –LDAPFilter "(!memberOf=$ShadowGroup1)" | ForEach-Object {Add-ADPrincipalGroupMembership –Identity $_ –MemberOf $ShadowGroup1}

[chazzy2501]

Yes, I'd rethink your schema to go by enrolment year, if a pupil joins late then you add them to the year they would have started. You're just inviting unnecessary housekeeping and opportunities to make annoying mistakes.

[Oaktech]

We used to do that. It was a PITA.

 

YearOfEntryFirstnameLastIntitial

 

17DaveS

 

No roll forward required, set GPOs once and remove when they leave.