Updating AD Group Memberships

hello,

i trying take members of security group/distribution list contains many nested groups , add all of them sg.  able complete on first pass, when target sg empty.  users added , none of nested groups are  carried over.  however, running issue on subsequent passes.  receive error 'specified account name member of group'.  guess first remove members of target group , update membership each time run process, curious know if there possibility skip existing users , add added users source groups.  there dozen users in target group static entries , not exist in of source groups, present challenge.

$erroractionpreference = "stop"  try {  import-module activedirectory  $groupname = get-adgroup $targetgroup -properties members | select-object members | foreach { $_.members}  get-adgroupmember -identity $sourcegroup | {$_.objectclass -ne "group"} | foreach {      if($_.samaccountname -notcontains $_)      {          add-adgroupmember -identity $targetgroup -member $_          $_       }      }  get-adgroup $sourcegroup | get-adgroupmember | {$_.objectclass -eq "group"} | get-adgroup -properties members | select-object members | foreach {$_.members} | foreach {      if($_.samaccountname -notcontains $_)      {          add-adgroupmember -identity $targetgroup -member $_          $_       }      }  } catch {                $_ | out-file d:\ps\problemupdatinggroupsreport.txt -append -width 1000  }

thanks in advance , assistance.  also, special siva mulpuru , blog getting me started down path in accomplishing (http://smulpuru.wordpress.com/).

regards,
brian

give script try. created recursive function, when pass group, checks see if member group , if so, calls again. returns final array of users distinguished names, , before adding user target group, checks see if member of.

function getmembers { 	param 	( 		[string]$groupname 	) 	$allmembers = @() 	$members = get-adgroupmember $groupname 	 	foreach ($member in $members) 	{ 		if ($member.objectclass -eq "group") 		{ 			getmembers $member.samaccountname 		} 		else 		{ 			$allmembers += $member.distinguishedname 		} 	} 	 	return $allmembers }  $sourcegroup = "source group name" $targetgroup = "target group name" $targetgroupdn = get-adgroup $targetgroup | select-object -expandproperty distinguishedname  getmembers $sourcegroup | foreach-object { 	if (!(@(get-aduser $_ -properties memberof | select-object -expandproperty memberof) -contains $targetgroupdn)) 	{ 		add-adgroupmember -identity $targetgroup -members $_
	} }

did not test add-adgroupmember portion dont have test ad environment play in. used write-host instead view information, may want add -whatif switch see happen , verify correct before proceeding.

---

if find post has answered question, please mark answer. if find post helpful in anyway, please click vote helpful.

Windows Server  >  Windows PowerShell