0

I am able to export to users that are not members of particular groups such as IT_Group like below. But, this script gives me all membership of users within memberof column in csv output. If they are members of any groups that matches "IT" they should be displayed within memberof column in csv output like below.

Also , If user is not member to any group that is beginning with IT_ then it will write "any IT group is not member" keyword within memberof column in csv output.

There are 3 security groups such as IT_Group,IT_Group1,IT_Group2

I have tried so far :

Get-ADUser -Filter {(emailaddress -like "*@contoso.com" -and Enabled -eq $false -and sAMAccountName -like "TEST*") -or (emailaddress -like "*@contoso.com" -and Enabled -eq $false -and sAMAccountName -like "PROD*")} -SearchBase "OU=USERS,DC=contoso,DC=com" -SearchScope Subtree -Properties * | Where { [string]$_.memberof -notmatch 'IT_Group'} | Select-Object name , samaccountname ,@{Name="MemberOf";Expression={($_.MemberOf | %{(Get-ADGroup $_).sAMAccountName}) -Join ";"}} |Export-CSV -Path "C:\tmp\output.csv" -NoTypeInformation -Encoding UTF8

My Desired output :

name,samaccountname,memberof
User01,TEST1,IT_Test
User02,PROD1,IT_Prod
User03,TEST4,any IT group is not member
4
  • You wanna get all users that in groups beggining with "IT_", or list of users and their all groups that at least have one group begging with "IT_"?
    – Vad
    Mar 4, 2020 at 8:41
  • Hi , I have updated my question.
    – Arbelac
    Mar 4, 2020 at 10:00
  • when you do filtering you already exclude users who are not in these groups
    – Vad
    Mar 4, 2020 at 11:00
  • sorry , I have edited my desired output
    – Arbelac
    Mar 4, 2020 at 11:04

2 Answers 2

1

The -Filter should not be written as script block ({..}), but as a normal string.

This should do what you are after:

$filter = "(Enabled -eq 'False' -and EmailAddress -like '*@contoso.com') -and (SamAccountName -like 'TEST*' -or SamAccountName -like 'PROD*')"
Get-ADUser -Filter $filter -SearchBase "OU=USERS,DC=contoso,DC=com" -SearchScope Subtree -Properties EmailAddress, MemberOf | ForEach-Object {
    if ($_.MemberOf -match 'CN=IT_(Test|Prod)') {
        # the user is a member of any IT_Group, get the names of all groups for this user
        $groups = foreach ($grp in $_.MemberOf) { (Get-ADGroup -Identity $grp).Name }
        $_ | Select-Object Name, SamAccountName, @{Name = 'MemberOf'; Expression = {$groups -join ', '}}
    }
    else {
        # the user is not a member of any IT_Group
        $_ | Select-Object Name, SamAccountName, @{Name = 'MemberOf'; Expression = {'Not a member of any IT_Group'}}
    }
} | Export-CSV -Path "C:\tmp\output.csv" -NoTypeInformation -Encoding UTF8

Parsing the name of an object from the DistinghuishedName is tricky, because there can be special characters in there. That is why this code uses the Get-ADGroup cmdlet to get the group names.


If the SamAccountNames do not matter and you want to get ALL users in OU OU=USERS,DC=contoso,DC=com that are not Enabled AND have an EmailAddress ending in @contoso.com, than simply change the $filter variable to

$filter = "Enabled -eq 'False' -and EmailAddress -like '*@contoso.com'"

As per your latest comment, you would only want to list the groups IT_Test and/or IT_Prod for users that are member of any of these two groups, the code below should do that:

$filter = "(Enabled -eq 'False' -and EmailAddress -like '*@contoso.com') -and (SamAccountName -like 'TEST*' -or SamAccountName -like 'PROD*')"
Get-ADUser -Filter $filter -SearchBase "OU=USERS,DC=contoso,DC=com" -SearchScope Subtree -Properties EmailAddress, MemberOf | ForEach-Object {
    $testgroups = $_.MemberOf | Where-Object { $_ -match 'CN=IT_(Test|Prod)'}
    if ($testgroups) {
        # the user is a member of group IT_Test and/or IT_Prod, get the names of these groups for this user
        $groups = foreach ($grp in $testgroups) { (Get-ADGroup -Identity $grp).Name }
        $_ | Select-Object Name, SamAccountName, @{Name = 'MemberOf'; Expression = {$groups -join ', '}}
    }
    else {
        # the user is not a member of any IT_Group
        $_ | Select-Object Name, SamAccountName, @{Name = 'MemberOf'; Expression = {'Not a member of any IT_Group'}}
    }
} | Export-CSV -Path "C:\tmp\output.csv" -NoTypeInformation -Encoding UTF8

Hope that helps

7
  • I am getting Get-ADUser : Error parsing query:
    – Arbelac
    Mar 4, 2020 at 11:30
  • @Arbelac I have changed the syntax of the filter. (using 'False' and added brackets) Can you try please?
    – Theo
    Mar 4, 2020 at 12:56
  • thanks for your answer . But I forgot to say something. it was 2 security group but not like IT_Group , so there are IT_Test and IT_Prod. Due to that your filtering does not correctly work. How can I do that ? thanks
    – Arbelac
    Mar 4, 2020 at 14:07
  • @Arbelac I have changed if ($_.MemberOf -match 'CN=IT_Group') into if ($_.MemberOf -match 'CN=IT_(Test|Prod)'). You are still looking for users with SamAccountNames Test* and/or PROD* ?
    – Theo
    Mar 4, 2020 at 14:12
  • thanks again , it working correctly part the user is not a member of any IT_Group. But , it return still the names of all groups for anyuser. I don't want to export all groups of user. Just if user is member of group it_prod and/or test it will be return IT_Test and / or IT_Prod. I have updated my desired output in my question
    – Arbelac
    Mar 4, 2020 at 16:48
0

This code get all users that have groups begining with "IT_" it's provided by $_.memberof -like 'CN=IT_*'.Then for each user getting his name,login and groups what beggins from"CN=IT_",format it with -replace and add it to csv file without rewrite.

$users=Get-ADUser -Filter {filter options}  -Properties MemberOf| Where-Object { $_.memberof -like '*CN=IT_*'}
foreach ($user in $users){    
$user|Select-Object name , samaccountname ,@{Name="MemberOf";Expression={((($_.MemberOf | Select-String -Pattern 'CN=IT_*')-replace "CN=")-replace ",.+$") -Join ";"}} |Export-CSV -Delimiter ';' -Path "D:\testdir\uss.csv" -NoTypeInformation -Encoding UTF8 -Append
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.