2

I have written this bit of PS to add users from a text file to and AD group that the user inputs. It works fine except for the if statement. The if statement is supposed to check the group to see if the users in the text file are already group members. So, the $item variable gets initialized with 'jdoe' and the $member variable gets initialized as so:

$member=Get-ADGroupMember -identity $group | select SamAccountName

The problem member will get initialized with @{SamAccountName=JDoe}, @{SamAccountName=bsmith}, etc. Basically, all the members in one foul swoop and encapsulated with the additional data thus obscuring the data used for the comparison. Here is my code in it's entirety. I would appreciate any help. Thanks

#User input group name
$group=read-host -prompt "Enter group name:"

#Loop through each item in text file
foreach ($item in Get-Content C:\addusers.txt) {
    #If user is already a member of group...
    $member = Get-ADGroupMember -identity $group | select SamAccountName
    if ($member -eq $item) {
         Write-Host $item "is already a member of" $group
    }

    #add to group
    Add-ADGroupMember -Identity $group -Member $item
}

1 Answer 1

4

The first problem is your comparison. The line that assigns a value to $member returns a list, not a single item. So you are basically asking in the test "if this big list is equal to a single item." That condition will never be true, except perhaps is the group has only one member (I am not sure if you will get a single item in that case, or an array object with one member).

Second issue is that you don't do anything with this test's results--you still run the group addition even if the user is already in the group (assuming your test was written correctly). Why?

It also has a lot of overhead, as it will run this dump of the group's contents each time you run it. Better would be to get the group members once, outside of your foreach loop, and then use an array search on that list inside the foreach loop. That's less of a concern, but may be worth fixing.

PS--you can add a user to a group even if they are already a member of the group. So you may want to remove this comparison altogether:

foreach ($user in get-content $userspath) {
    Add-ADGroupMember -Identity $group -Member $user
}

Edit: If you still want to search for the existence of a member in the group, you could do it like this:

$u = get-aduser $user -properties "memberof"
if ($u.memberOf -contains (get-adgroup $group) ) 
    ...
6
  • Thank you. I did understand when I posted that this returns a list and I wasn't clear enough. I was unsure how to draw each user individually rather than in a list to do the comparison.You are correct, I left out an else with brackets but just did not get to that point as I was engrossed in this problem. I will take your advice and get the group members outside the loop, that makes sense. Everytime I add a user into a group that is already a member I get: "Add-ADGroupMember : The specified account name is already a member of the group". I get the same results when I manually try to add a user
    – user179037
    Aug 14, 2013 at 19:14
  • (cont.) in ADUC so I am unsure if your last statement is correct.
    – user179037
    Aug 14, 2013 at 19:17
  • BTW- I am brand new to powershell so even this bit is a triumph for me. Thanks for your help.
    – user179037
    Aug 14, 2013 at 19:19
  • Not sure if you'll see my edits--I added two lines you could use to search for the membership in the group. The get-aduser and get-adgroup are needed because you need the DN, not the samAccountName or simple version of the group name.
    – Quinten
    Aug 14, 2013 at 20:19
  • $u = get-aduser $user -properties "memberof" if ($u.memberOf -contains (get-adgroup $group) ) { Write-Host $user "is already a member of" $group }else { #add to group Add-ADGroupMember -Identity $group -Member $user
    – user179037
    Aug 15, 2013 at 20:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .