Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I would like to create a dynamic group with users from a specific OU in my Active Directory. I can do this perfectly using Exchange Dynamic Distribution List, but of course, Ex DDL's are only for mail.

There's any way to create this? I've found some guides using System Center to handle this, but System Center isn't an option.

Thanks in advance,

share|improve this question

4 Answers 4

up vote 4 down vote accepted

There is no such thing as a Dynamic Security Group in Active Directory, only Dynamic Distribution groups.

To accomplish this, I think the most viable option would be to have a Powershell script determining who are in the given OU and updating the security group accordingly, maybe like this:

Import-Module ActiveDirectory
$groupname = PseudoDynamicGroup
$users = Get-ADUser -Filter * -SearchBase "ou=desiredUsers,dc=domain,dc=tld"
foreach($user in $users)
  Add-ADGroupMember -Identity $groupname -Member $user.samaccountname -ErrorAction SilentlyContinue
$members = Get-ADGroupMember -Identity $groupname
foreach($member in $members)
  if($member.distinguishedname -notlike "*ou=desiredUsers,dc=domain,dc=tld*")
    Remove-ADGroupMember -Identity $groupname -Member $member.samaccountname
share|improve this answer
+1 Can I have such a script run on my Active Directory periodically to make sure my AD groups are up-to-date? Or maybe somehow subscribe to some event system? I'm a developer not an administrator but I can influence the administrator and my manager – Mzn Feb 19 '14 at 6:29
I'd do the removes first, just so it doesn't recheck user objects we just checked (and added) – ST8Z6FR57ABE6A8RE9UF Sep 7 at 10:30

I'm answering my own question. With the PowerShell ideas of Mathias I've found this on the internet:


  • Sync user or computer objects from one or more OUs to a single group.
  • Ability to filter objects included in the shadow group using the PowerShell Active Directory Filter.
  • Ability to choose shadow group type (Security/Distribution).

The author's blog contains additional information about the design and motives for the tool.

share|improve this answer
If Mathias was the one who helped you, then you should accept his answer. He give you the insight! – Mzn Feb 19 '14 at 6:27

This can be done with Adaxes. Technically it will dynamically update group membership once users are updated/moved. Here's an example how to automatically maintain group membership based on Department attribute, but it's very easy to modify it to do same thing based on the OU.

share|improve this answer

I've also looked for a way to create dynamic security groups in Active Directory, and came to the conclusion as Mathias. My solution wasn't as elegant as his, I use a scheduled powershell-script to remove all users from the groups, and then fill them with the users in the OU. In addition I made sure that the sub-OUs groups got added to the parent OUs security group where it fitted.

import-module ActiveDirectory
Get-ADGroupMember OU_GroupName | % { Remove-ADGroupMember 'OU_GroupName' -Members $_ -Confirm:$false}
Get-ADUser -SearchBase 'OU=OUName,OU=ParentOUName,DC=DomainName,DC=TopDomainName' -Searchscope 1 -Filter * | % { Add-ADGroupMember 'OU_GroupName' -Members $_ }
Add-ADGroupMember -Identity "OU_ParentName" -Members "OU_ChildOneName", "OU_ChildTwoName", "OU_ChildThreeName"

Not sure if this scales well in a big company, but the script only use a few minutes in our 300 user company.

share|improve this answer
From a practical vantage point, your solution is fine (for a few hundred users). However, by adding all first (and suppressing warnings/errors for duplicates), and then removing only non-matches, you 1) minimize the number of attribute updates to the AD object and 2) workaround the risk of somebody authenticating and missing a Security Group in their token, should they happen to come online while your script is running. – Mathias R. Jessen Apr 5 '13 at 21:05

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.