Simple (I hope) Powershell Script Check? Add/Remove AD Group From Another AD Group

[Miscbrah]

Afternoon everyone.

 

Just a bit too scared to fumble around here and experiment! Hoping if anyone passing is awesome in Powershell they could give me a hand or cast an eye over this before I press buttons.

 

What I want to do ideally is have two scheduled tasks that each run a Powershell script. One to add a group in AD into another group, and then another script to remove that group from the AD group. So, in the morning for example the "RECEPTION" AD group and all members would be made a member of the AD group "COLOURING IN" and then at 4pm another script runs that removes the RECEPTION group from COLOURING IN.

 

Adding them I would say run this:

 

Add-ADGroupMember -Identity "COLOURING IN" -Members "RECEPTION"

 

And then removing them I would say is this:

 

Remove-ADGroupMember -Identity "COLOURING IN" -Members "RECEPTION"

 

Is this looking right? I know it might be a bit basic but I'm scared!

 

Thanks everyone for having a look.

[David44]

Just press Enter!

 

What is the worst that can happen, a group will be either added to another group or it won't. You can correct anything using the GUI afterwards anyway.

 

You could also add -WhatIf to the end of the commands, this will tell you (sometimes slightly cryptically) what the command will do, without actually doing it.

 

To answer your question, that looks right to me.

[ThomL]

I think you might need to get all the users from the reception group and then for each user add or remove them from the other group - this might work:

 

# Add to Group
Get-ADGroupMember -Identity "RECEPTION"  | ForEach-Object { Add-ADGroupMember -Identity "COLOURING IN" -Members $_ }

# Remove from Group
Get-ADGroupMember -Identity "RECEPTION"  | ForEach-Object { Remove-ADGroupMember -Identity "COLOURING IN" -Members $_ }

[DaveTheTech]

The cmdlet would be looking for samaccountnames.

I would have thought you would need to do something like:

Add-ADGroupMember -Identity "COLOURING IN" -Members $(get-adgroup "RECEPTION")

[ThomL]

The cmdlet would be looking for samaccountnames.

I would have thought you would need to do something like:

Add-ADGroupMember -Identity "COLOURING IN" -Members $(get-adgroup "RECEPTION")

It looks like it should accept a user object in the way I posted. From example three, doesn't get-aduser return a user object?: Add-ADGroupMember (ActiveDirectory) | Microsoft Learn

[DaveTheTech]

That correct, it does.

However, in your post you said the reception group.

Your initial code, would add the user called reception, not the group.

 

You can get the members of the reception group and then add those or add the group as a member.

[ThomL]

That correct, it does.

However, in your post you said the reception group.

Your initial code, would add the user called reception, not the group.

 

You can get the members of the reception group and then add those or add the group as a member.

 

Apologies, I didn't realise you were talking about OP's PowerShell - I thought you were replying in reference to my post!

[DaveTheTech]

Apologies, I didn't realise you were talking about OP's PowerShell - I thought you were replying in reference to my post!

Seems we cross posted a bit, I was meant to reply to the OP.

I used to use your method.

However, if you set the group members to avariable, you don't have to use for each.

Depending on how much work you are doing, can save a bit of time.

[Miscbrah]

You folks are amazing thanks so much.

 

Ok this looks like the one then!

 

I think you might need to get all the users from the reception group and then for each user add or remove them from the other group - this might work:

 

# Add to Group
Get-ADGroupMember -Identity "RECEPTION"  | ForEach-Object { Add-ADGroupMember -Identity "COLOURING IN" -Members $_ }

# Remove from Group
Get-ADGroupMember -Identity "RECEPTION"  | ForEach-Object { Remove-ADGroupMember -Identity "COLOURING IN" -Members $_ }

 

I'll press enter tomorrow.

 

Thanks again!

[David44]

This doesn't quite look like what you wanted to do originally. You said you wanted two scripts "One to add a group in AD into another group, and then another script to remove that group from the AD group". What you have posted above will take each member of the group RECEPTION and add them directly to group COLOURING IN. It will not add the group RECEPTION to group COLOURING IN. It's a subtle difference that may not matter in your scenario.

 

When you run the Remove from Group script, you will be removing all users from COLOURING IN who are also members of RECEPTION. This includes any user who might already have been a member of COLOURING IN. Maybe you have users who should be permanent members of RECEPTION and COLOURING IN, this will break that.

[jthompson]

Afternoon everyone.

 

Just a bit too scared to fumble around here and experiment! Hoping if anyone passing is awesome in Powershell they could give me a hand or cast an eye over this before I press buttons.

 

What I want to do ideally is have two scheduled tasks that each run a Powershell script. One to add a group in AD into another group, and then another script to remove that group from the AD group. So, in the morning for example the "RECEPTION" AD group and all members would be made a member of the AD group "COLOURING IN" and then at 4pm another script runs that removes the RECEPTION group from COLOURING IN.

 

Adding them I would say run this:

 

Add-ADGroupMember -Identity "COLOURING IN" -Members "RECEPTION"

 

And then removing them I would say is this:

 

Remove-ADGroupMember -Identity "COLOURING IN" -Members "RECEPTION"

 

Is this looking right? I know it might be a bit basic but I'm scared!

 

Thanks everyone for having a look.

 

Those commands will work, but for the Remove-ADGroupMember command, you may need to add -Confirm:$False so that it doesn't get help up with a confirmation prompt:

Remove-ADGroupMember -Identity "COLOURING IN" -Members "RECEPTION" -Confirm:$False

[Miscbrah]

This doesn't quite look like what you wanted to do originally. You said you wanted two scripts "One to add a group in AD into another group, and then another script to remove that group from the AD group". What you have posted above will take each member of the group RECEPTION and add them directly to group COLOURING IN. It will not add the group RECEPTION to group COLOURING IN. It's a subtle difference that may not matter in your scenario.

 

When you run the Remove from Group script, you will be removing all users from COLOURING IN who are also members of RECEPTION. This includes any user who might already have been a member of COLOURING IN. Maybe you have users who should be permanent members of RECEPTION and COLOURING IN, this will break that.

 

Morning - yep thanks for that, did spot that and did factor it in. It will achieve the end result so it's all good. Cheers.

[Miscbrah]

Works like a charm thanks everyone for the help.

 

Did have to stick a confirm switch on the remove script to bypass prompts but all perfect.