We restrict the running of exe's across the organization. But based on justifications & approvals we add users to (specific) AD groups for 24 hours.

Currently the process of removing the users from those AD groups after X hours is manual. I am trying to automate it in some fashion. But I was wondering if there is any native way of handling this within AD 2003. Is writing a script (powershell / vbs) the only way of handling this?


Assuming all your Domain Controllers are Windows Server 2003 or later you can do this with native Active Directory's dynamic objects functionality without any scripting.

Let's say that a user account, "Bob", needs to be in the "Accounting" group for 24 hours.

  • Create a "Bob in Accounting 24 Hours" group and specify an entry-TTL for 24 hours (the duration you want the group to remain in the Active Directory) at the time of creation.

  • Add the "Bob in Accounting 24 Hours" as a member of the "Accounting" group

  • Add the "Bob" user account as a member of the "Bob in Accounting 24 Hours" group

Upon the "Bob" user account's next logon it will be a member of the "Accounting" group through the nested group membership of the "Bob in Accounting 24 Hours" group into the "Accounting" group. At the end of 24 hours all the domain controllers will garbage-collect the "Bob in Accounting 24 Hours" group and "Bob" will no longer be a member of "Accounting".

The trick is that non-dynamic objects cannot be converted to dynamic after their creation. Using group nesting, though, gets you around that limitation in this instance.

You'll need to use a tool other than "Active Directory Users and Computers" to create the group because you'll need to set the entry-TTL at the time of the group's creation. The script in this blog entry might be a starting place (it's built to create User objects) or, alternatively, you could just use ldifde or csvde to do the creation, too.

  • 5
    Holy crap, that is something I did not know about. And it's 10 years old. – mfinni Jul 8 '13 at 21:26
  • 1
    @mfinni - I've never used it in production, ever. It works exactly as-advertised, though. Pretty neat, eh? – Evan Anderson Jul 8 '13 at 21:26
  • 6
    i.imgur.com/TZX2RbP.jpg – MDMarra Jul 8 '13 at 22:25
  • 2
    @EvanAnderson You're a badass. – Ryan Ries Jul 9 '13 at 0:51
  • 2
    You're all too kind. There's some really good background on the feature in this blog (this guy really is an AD badass-- I just use the product a lot): blogs.chrisse.se/2012/11/28/… – Evan Anderson Jul 9 '13 at 1:05

You could handle this a few ways, none are native to AD:

  1. Write a script and put it in task scheduler. Have it query a text file or CSV somewhere on the network with the current list. Have it remove people not on that list at runtime.

  2. Use something like System Center Orchestrator to create a runbook to add users to the group and to remove them after X hours automatically.

  3. Make an Outlook reminder to take people out manually :)

  • 1
    FYI - We use Quest's ActiveRoles server to assist with AD management. It has the capability built in along with a little workflow tool added to assist. – uSlackr Jul 8 '13 at 16:39
  • I think using option 1 and creating a scheduled PowerShell script with a file of current users is a good way to solve this. – jer.salamon Jul 8 '13 at 17:01
  • 5
    You cannot resist the siren song of dynamic objects... Dynamic objects! – Evan Anderson Jul 8 '13 at 21:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.