Public/Add-ADSIGroupMember.ps1

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
function Add-ADSIGroupMember
{
<#
.SYNOPSIS
    Function to add a group member
 
.DESCRIPTION
    Function to add a group member
 
.PARAMETER Identity
    Specifies the Identity of the group
 
    You can provide one of the following properties
        DistinguishedName
        Guid
        Name
        SamAccountName
        Sid
        UserPrincipalName
     
    Those properties come from the following enumeration:
        System.DirectoryServices.AccountManagement.IdentityType
 
.PARAMETER Member
    Specifies the member account.
    Performing an Ambiguous Name Resolution LDAP query to find the account.
    http://social.technet.microsoft.com/wiki/contents/articles/22653.active-directory-ambiguous-name-resolution.aspx
 
.PARAMETER Credential
    Specifies the alternative credential to use.
    By default it will use the current user windows credentials.
 
.PARAMETER DomainName
    Specifies the alternative Domain where the user should be created
    By default it will use the current domain.
 
.EXAMPLE
    Add-ADSIGroupMember -Identity TestADSIGroup -Member 'UserTestAccount1'
 
    Adding the User account 'UserTestAccount1' to the group 'TestADSIGroup'
 
.EXAMPLE
    Add-ADSIGroupMember -Identity TestADSIGroup -Member 'GroupTestAccount1'
 
    Adding the Group account 'GroupTestAccount1' to the group 'TestADSIGroup'
 
.EXAMPLE
    Add-ADSIGroupMember -Identity TestADSIGroup -Member 'ComputerTestAccount1'
 
    Adding the Computer account 'ComputerTestAccount1' to the group 'TestADSIGroup'
 
.NOTES
    Francois-Xavier.Cat
    LazyWinAdmin.com
    @lazywinadm
    github.com/lazywinadmin
#>

[CmdletBinding(SupportsShouldProcess=$true)]
PARAM(
    [parameter(Mandatory=$true, ValueFromPipelineByPropertyName=$true, ValueFromPipeline=$true)]
    $Identity,
    [Alias("RunAs")]
    [System.Management.Automation.PSCredential]
    [System.Management.Automation.Credential()]
    $Credential = [System.Management.Automation.PSCredential]::Empty,
    [String]$DomainName,
    $Member
    )

    BEGIN
    {
        Add-Type -AssemblyName System.DirectoryServices.AccountManagement
        
        # Create Context splatting
        $ContextSplatting = @{
            Contexttype = "Domain"
        }
        
        IF ($PSBoundParameters['Credential']){$ContextSplatting.Credential = $Credential}
        IF ($PSBoundParameters['DomainName']){$ContextSplatting.DomainName = $DomainName}
        
        $Context = New-ADSIPrincipalContext @ContextSplatting
    }
    PROCESS
    {
        TRY{
            # Resolving member
            # Directory Entry object
            $DirectoryEntryParams = $ContextSplatting.remove('ContextType')
            $DirectoryEntry = New-ADSIDirectoryEntry @DirectoryEntryParams
            
            # Principal Searcher
            $DirectorySearcher = new-object -TypeName System.DirectoryServices.DirectorySearcher
            $DirectorySearcher.SearchRoot = $DirectoryEntry
            
            # Adding an Ambiguous Name Resolution LDAP Filter
            $DirectorySearcher.Filter = "(anr=$member)"
            
            # Retrieve a single object
            $Account = $DirectorySearcher.FindOne().GetDirectoryEntry()

            if($Account)
            {
                switch ($Account.SchemaClassName)
                {
                'user' {$member =[System.DirectoryServices.AccountManagement.UserPrincipal]::FindByIdentity($Context, $Account.distinguishedname)}
                'group' {$member = [System.DirectoryServices.AccountManagement.GroupPrincipal]::FindByIdentity($Context, $Account.distinguishedname)}
                'computer' {$member = [System.DirectoryServices.AccountManagement.ComputerPrincipal]::FindByIdentity($Context, $Account.distinguishedname)}
                }
            }
            

            if ($pscmdlet.ShouldProcess("$Identity", "Add Account member $member")){
                $group =(Get-ADSIGroup -Identity $Identity @ContextSplatting)
                $group.members.add($Member)
                $group.Save()
            }
        }
        CATCH{
            Write-Error $Error[0]
        }
    }
}