5

Machines get added to a security group to prevent them from getting a GPO. I'd like the machines to get removed after 30 days of being in the group. Ideally, I'd like to also be able to generate a report on the machines in the group.

Something like:

MachineA - 10 Days left

MachineB - 29 Days left

2 Answers 2

10

Provided you have a Windows 2012 Domain controller, yes!


Where can we find group membership details?

When you look into the member attribute of an AD group you’ll find a list of all members in distinguished name format. But that’s it. There is no smoking gun or finger prints that tell you how they got there. However, there is a little-known piece of data called replication metadata that can tell us exactly what we need. This data is quite special for groups, because it shows us the date individual members were added and removed. Awesome! But if you try to view it in the GUI it looks like ugly hex.

[...]

The Script

Here is the PowerShell goodness we’ve been awaiting (also attached at the bottom of the post):

Import-Module ActiveDirectory            

$username = "janitor"            
$userobj  = Get-ADUser $username            

Get-ADUser $userobj.DistinguishedName -Properties memberOf |            
 Select-Object -ExpandProperty memberOf |            
 ForEach-Object {            
    Get-ADReplicationAttributeMetadata $_ -Server localhost -ShowAllLinkedValues |             
      Where-Object {$_.AttributeName -eq 'member' -and             
      $_.AttributeValue -eq $userobj.DistinguishedName} |            
      Select-Object FirstOriginatingCreateTime, Object, AttributeValue            
    } | Sort-Object FirstOriginatingCreateTime -Descending | Out-GridView

enter image description here

2
  • Awesome. Now all I have to do is upgrade all the DCs to 2012 :-P
    – MathewC
    Dec 11, 2014 at 18:03
  • @MathewC Actually, so long as you upgrade one of the DCs to 2012, you should be alright. For that matter, I suspect you just need to run the script from a W8+/WS2012+ machine, whether your DCs are 2012 or not, but I can't verify that suspicion, because all the domains I have access to have 2012 DCs in them. Dec 11, 2014 at 18:35
5

The only thing I can think of to solve this is a trick where you use an intermediate group as a dynamic object and then nest that into the primary group so that the user has the permissions conferred to the primary group by way of nested group membership, however, the intermediate group has a TTL (time to live, the entry-TTL attribute) and when that TTL expires, the group will disappear and thus the nested group membership will vanish. Name the temporary group something like "MachineA 30 Day Temporary" or something.

This is referred to as "Dynamic Objects."

5
  • Muahaha! See my answer. Looks like I finally found something in Windows-land I know about that you didn't. Woohoo! I'm just gonna enjoy this warm, fuzzy feeling while it lasts. :) Dec 10, 2014 at 15:58
  • 1
    @HopelessN00b Your answer's good, I'm going to upvote it, but I'm still thinking the dynamic objects approach is probably still the easier approach to getting machines to automatically stop applying a GPO automatically after 30 days. Using the replication metadata, you have successfully answered the question of when a machine was added to a group, but you still have a lot of work left to do to go from there to "MachineA automatically stops applying a GPO after 30 days."
    – Ryan Ries
    Dec 10, 2014 at 16:12
  • Well, yeah, but... you see, the... in this case... shit. I knew that warm fuzzy wouldn't last long. Guess I got over-excited when I saw I knew something you didn't. :( Having said that, wouldn't it be a simple matter of FirstOriginatingCreateTime > Today.AddDays(-30) and Remove-ADGroupMember to get from that Technet blog's script to where the OP wants to go? Dec 10, 2014 at 16:22
  • This is cool. But you're saying you'd have to create a separate group for each machine, nested in the group I want them removed from? Thanks!
    – MathewC
    Dec 11, 2014 at 18:03
  • Yep, or at least one group per day and then put all of that day's machines into the same temporary group. I know it's not exactly cute, but it's the first thing I thought of. I am not surprised you like @HopelessN00b's answer better. I kinda' do too. :)
    – Ryan Ries
    Dec 11, 2014 at 18:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .