Identifying Users Not in a Specific Active Directory Group with PowerShell

Estimated reading time: 4 minutes

Introduction

Managing Active Directory (AD) groups is an essential task for IT administrators, especially in large organizations. Ensuring that users are in the correct security groups can be a time-consuming task.

This blog post will walk you through a PowerShell script that automates the process of identifying users who are not members of a specific security group.

This script is particularly useful for checking compliance with policies like folder redirection to OneDrive.

Problem Statement

The Challenge of Managing AD Groups

Active Directory groups are often used to apply specific settings or permissions to a subset of users. In this scenario, we need to ensure that all relevant users are part of the “Folder Redirection to OneDrive” security group. Manually verifying group membership for a large number of users can be inefficient and prone to errors.

Real-World Scenario

For instance, in our organization, any user not in the “Folder Redirection to OneDrive” group will not have their folders redirected, leading to inconsistent user experiences and potential data management issues.

Solution: A PowerShell Script to Identify Users Not in an AD Group

Script Overview

The script outlined below performs the following actions:

1. Retrieve All Domain Users: The script gathers all users within the specified domain.
2. Identify Group Members: It fetches all members of the specified security group.
3. Compare Users: The script compares the list of all domain users against the group members.
4. Generate a Report: A CSV file is generated listing users who are not members of the specified group.

Here is the PowerShell script:

# Define the group name and domain
$groupName = "Folder Redirection to OneDrive"
$domain = "domain.com"
$outputFile = "C:\UsersNotInGroup.csv"  # Path to save the CSV file

# Get the distinguished name of the group
$groupDN = (Get-ADGroup -Filter { Name -eq $groupName }).DistinguishedName

# Get all users in the domain
$allUsers = Get-ADUser -Filter * -SearchBase "DC=domain,DC=com" -Properties MemberOf

# Get all members of the specified security group
$groupMembers = Get-ADGroupMember -Identity $groupName -Recursive

# Create a hashset of group members' distinguished names for quick lookup
$groupMemberDNs = @{}
foreach ($member in $groupMembers) {
    $groupMemberDNs[$member.DistinguishedName] = $true
}

# Find users who are not in the security group
$usersNotInGroup = $allUsers | Where-Object {
    -not ($groupMemberDNs.ContainsKey($_.DistinguishedName))
}

# Output the users not in the group and export to CSV
$usersNotInGroup | Select-Object SamAccountName, Name, DistinguishedName | Export-Csv -Path $outputFile -NoTypeInformation

Write-Output "CSV export completed. File saved to: $outputFile"

Step-by-Step Explanation

Setting Up Variables

The script starts by defining key variables: the group name ($groupName), the domain ($domain), and the output file path ($outputFile).

Retrieving the Distinguished Name of the Group

Using Get-ADGroup, the script retrieves the distinguished name (DN) of the security group. The DN is essential for identifying the group within Active Directory.

Fetching All Domain Users

The Get-ADUser cmdlet retrieves all users in the domain. The -SearchBase parameter scopes the search to the specified domain.

Retrieving Group Members

Get-ADGroupMember is used to get all members of the security group. The -Recursive parameter ensures that nested group members are included.

Creating a Hashset for Fast Lookup

A hash table of group members’ DNs is created for quick lookup during comparison, which enhances script performance.

Identifying Users Not in the Group

The script compares all domain users against the hash table to find users not in the security group.

Exporting Results to CSV

Finally, the script exports the list of users not in the group to a CSV file, which can be easily reviewed.

Conclusion

This PowerShell script provides an efficient way to ensure that users are correctly assigned to specific security groups in Active Directory. Automating this process not only saves time but also reduces the risk of errors.

FAQ

Glossary

Active Directory (AD)

A directory service developed by Microsoft for Windows domain networks.

Distinguished Name (DN)

A unique name that identifies an entry in Active Directory.

Security Group

A group in AD used to assign permissions to shared resources.