PowerShell to add new user to specific groups

eric-schroeder · 2021-11-04T19:39:16.000Z

I am setting up a large powershell script with dialog boxes to do the following:

Setup new user
Set basic password
Set individual AD attributes
Add MFA Secure Auth number
Add Company Name
Add Address
Add to specific Teams Groups
Assign a baseline of sec groups they will all need
Assign specific groups as per their “role” (I.E. Project managers will be in PM group or IT will be put it the IT groups)

I have most of it but I am not a great programmer so my thought would be to display a message box then have a button for all the special depts (about 26 of them unfortunately) and then have a for loop or something that says >> if this PM button is clicked >> then add them to PM, and any other groups.

Anyone have anything they have already done that is similar or perhaps better than this idea? I am an infrastructure and solutions architect so the code portion is not my string suit but I’m always willing to learn

Thanks

@powershelln00b

AdmiralKirk · 2021-11-04T20:16:38.000Z

I will make the most common first response: What have you tried and what were your results?

And the most common second response: Please post the relevant pieces of your code so we can help you with it. Please use the ‘Insert Code’ button. Please and thank you!

PLEASE READ BEFORE POSTING! Read if you're new to the PowerShell forum! PLEASE READ BEFORE POSTING! Read if you're new to the PowerShell forum!

Housekeeping aside, let’s see if we can get the conversation rolling. I would approach the problem in steps:

Build a list of the groups
1. Preferably dynamically, make a query that collects a list of groups that fit whatever criteria makes them the right ones to select from
2. You can manually include the groups, but the long term maintenance will be a pain
Figure out what kind of interface you want to use
1. You mentioned a pop-up box with a series of checkboxes
2. I’ve never done a pop-up box on top of an existing form, so can’t help you much with that, hopefully someone else can chime in
Collect the selections as a variable
Use a ForEach to run through the contents of the variable and add-adgroupmember ( Assuming you are on-premises AD and not AzureAD )
1. The code syntax for AzureAD is slightly different, but the logic flow is the same

Do you have any of this already done?

@eric-schroeder

eric-schroeder · 2021-11-04T20:39:46.000Z

Below is the code I am currently working on. The If statements will have the AzureAD will include the Add ad group. I was also considering trying to see if it would be possible to have a dialog/message box that includes a drop down with the entire list to select from and then run the if loops with the variables that are collected?

NOTE: This is only the “Add to specialized groups” section that I split out from the rest of the portions I created.


```
Add-Type -AssemblyName System.Windows.Forms
Add-Type -AssemblyName System.Drawing

$form = New-Object System.Windows.Forms.Form
$form.Text = 'New User name'
$form.Size = New-Object System.Drawing.Size(300,200)
$form.StartPosition = 'CenterScreen'

$okButton = New-Object System.Windows.Forms.Button
$okButton.Location = New-Object System.Drawing.Point(75,120)
$okButton.Size = New-Object System.Drawing.Size(75,23)
$okButton.Text = 'OK'
$okButton.DialogResult = [System.Windows.Forms.DialogResult]::OK
$form.AcceptButton = $okButton
$form.Controls.Add($okButton)

$cancelButton = New-Object System.Windows.Forms.Button
$cancelButton.Location = New-Object System.Drawing.Point(150,120)
$cancelButton.Size = New-Object System.Drawing.Size(75,23)
$cancelButton.Text = 'Cancel'
$cancelButton.DialogResult = [System.Windows.Forms.DialogResult]::Cancel
$form.CancelButton = $cancelButton
$form.Controls.Add($cancelButton)

$label = New-Object System.Windows.Forms.Label
$label.Location = New-Object System.Drawing.Point(10,20)
$label.Size = New-Object System.Drawing.Size(280,20)
$label.Text = 'What Department will the user be assigned too?:'
$form.Controls.Add($label)

$textBox = New-Object System.Windows.Forms.TextBox
$textBox.Location = New-Object System.Drawing.Point(10,40)
$textBox.Size = New-Object System.Drawing.Size(260,20)
$form.Controls.Add($textBox)

$form.Topmost = $true

$form.Add_Shown({$textBox.Select()})
$result = $form.ShowDialog()

if ($result -eq [System.Windows.Forms.DialogResult]::OK)
{
    $x = $textBox.Text
    $x
}

#### If Statements for special group additions

if ( 'Project Engineers' -eq $x )
{
    # do something
    Write-Output "You chose Project Engineers"
    Add-ADGroupMember -Identity Whatevergroup -Members $UPN
}

if ( 'Sr. Project Engineers' -eq $x )
{
    # do something
    Write-Output "You chose Sr. Project Engineers"
}

if ( 'Project Managers' -eq $x )
{
    # do something
    Write-Output "You chose Project Managers"
}

if ( 'Sr. Project Managers' -eq $x )
{
    # do something
    Write-Output "You chose Sr. Project Managers"
}

if ( 'Project Executive' -eq $x )
{
    # do something
    Write-Output "You chose Project Executive"
}

if ( 'Leadership' -eq $x )
{
    # do something
    Write-Output "You chose Leadership"
}

if ( 'Foreman' -eq $x )
{
    # do something
    Write-Output "You chose Foreman"
}

if ( 'Superintendents' -eq $x )
{
    # do something
    Write-Output "You chose Superintendents"
}

if ( 'Sr. Superintendents' -eq $x )
{
    # do something
    Write-Output "You chose Sr. Superintendents"
}

if ( 'PreCon' -eq $x )
{
    # do something
    Write-Output "You chose PreCon"
}

if ( 'PreCon Executive' -eq $x )
{
    # do something
    Write-Output "You chose PreCon Executive"
}

if ( 'Cost Engineer' -eq $x )
{
    # do something
    Write-Output "You chose Cost Engineer"
}

if ( 'Project Estimators' -eq $x )
{
    # do something
    Write-Output "You chose Project Estimators"
}

if ( 'Procraft' -eq $x )
{
    # do something
    Write-Output "You chose Procraft"
    #Ask if its a Driver or Operations Personnel
}

if ( 'CTI' -eq $x )
{
    # do something
    Write-Output "You chose CTI"
}

}
```

AdmiralKirk · 2021-11-04T21:47:05.000Z

I ran that code and see the pop-up, but it asks for free text input. I think a Listbox ( dropdown list ) would be your answer.

Assuming you have on-premises Active Directory, or hybrid on-premises with Azure, you can do this with AD cmdlets. If you’re AzureAD only then you will need to tweak for AzureAD cmdlets.
We are hybrid, and here is what I use to prepopulate a Department listbox for our HR team to use during hiring:

# Add text box to enter the Department
    $DepartmentTextBox = New-Object System.Windows.Forms.ComboBox
    $DepartmentTextBox.Location = 'x,y'
    $DepartmentTextBox.Size = 'x,y'
    [void] $DepartmentTextBox.Items.Add("") <# put a blank at the top of the list #>

    <# Pull the department list and populate into the listbox #>
    foreach ($Dept in Get-ADUser -filter " Department -Like '*'" -Properties Department | Select-Object Department | Sort-Object Department -Unique) {
        [void] $DepartmentTextBox.Items.Add($Dept)
    }
    $DepartmentTextBox.DisplayMember = "Department"

Then I have a function that triggers when the cursor leaves the listbox, whose purpose is to store the result where I can access it later. In my case it is a global variable called $UserInfo. Later on, when I create the user account, I just set the Department value to $Userinfo.Department

$DepartmentTextBox.Add_Leave({
     $UserInfo.Department = $DepartmentTextBox.Text
})

My approach is to pull all the values populated in the Department field for all users, then allow HR to select from the existing departments. I have additional filters on the Get-ADUser that I did not show, but at the minimum I’m only pulling user accounts that have a Department listed. This eliminates most of the system-generated service accounts -not that they have Departments anyway, but it could improve query performance. The thing I like about this approach is if we add, remove, or rename a Department, then the script will automatically provide the current list. I built it based on this StackOverflow entry: powershell - How to make output from array to listbox? - Stack Overflow
One advantage of a Listbox is that since it is only one line you can put it on your main form instead of a separate pop-up, which ought to simplify the code a bit.

Let me know if this makes sense, or if you have trouble adapting it, or whatever.

@eric-schroeder

eric-schroeder · 2021-11-05T15:00:23.000Z

I must be missing something because when I run your script to show the box I get errors for the “x” “y” values:

Exception setting "Location": "Cannot convert value "x,y" to type "System.Drawing.Point". Error: "x is not 
a valid value for Int32.""

AdmiralKirk · 2021-11-05T15:12:35.000Z

Eric-Schroeder:

I must be missing something because when I run your script to show the box I get errors for the “x” “y” values:
Exception setting "Location": "Cannot convert value "x,y" to type "System.Drawing.Point". Error: "x is not 
a valid value for Int32.""

You need to provide the x and y coordinates for where the object should be placed. I don’t know where your other objects are so I put in placeholders.

eric-schroeder · 2021-11-05T17:50:34.000Z

That is just for the actual Boxed Window correct?

AdmiralKirk · 2021-11-05T19:16:32.000Z

Eric-Schroeder:

That is just for the actual Boxed Window correct?

The coordinates in question are for the list box (dropdown list) that has the Departments in it.

gary-m-g · 2021-11-06T22:24:51.000Z

Eric,

Are there specific rules which can be maintained in a data store?
For example:
If Joe is a member of OrganizationalUnit “Data Scientist I”, then Joe is a member of Groups Alpha, Beta, Charlie, George.

If there are such rules and they’re operational definable and consistently applied, you can automate this.
I did it on our ASH; the underlying data file is UGLY but it works exactly as required.

The beauty of this is a user gets added to ONE and ONLY ONE OU and they automatically get added to all the necessary security groups.
Distribution Groups could be done but it wasn’t a requirement for my environment.

eric-schroeder · 2021-11-11T14:16:45.000Z

That would be more like nested groups. Is that what you mean?

eric-schroeder · 2021-11-11T14:19:27.000Z

AdmiralKirk:

Eric-Schroeder:

That is just for the actual Boxed Window correct?

The coordinates in question are for the list box (dropdown list) that has the Departments in it.

I’m sorry but I still don’t understand what you mean by coordinates. Are we talking about the DN location in AD? The actual box coordinates on the screen? As I said, I am more familiar with AD then I am programming or creating script to make list/dropdowns and such.

gary-m-g · 2021-11-11T14:31:09.000Z

Eric-Schroeder:

That would be more like nested groups. Is that what you mean?

Hi Eric,
Can be nested groups, can be many different groups.
However, the basis is a User’s OU defines which groups they belong to.
So, my code basically does:

If UserA is in OU=A,DC=contoso.com, then add them to the following Security Groups → List of groups.

Now, for simplicity sake, I am using IGDLA (see Nested Group BP ) so Gobal Groups end up being added to Domain Local Security Groups.
The beauty of this is the code removes users and groups which don’t belong and obviates the need to manage group membership manually.

The downside is the rules must be strictly maintained and, as I said, the source CSV file is ugly as can be.

eric-schroeder · 2021-11-11T14:48:26.000Z

Ok yes that is helpful and we have that partially setup now. For instance, specific roles get a specialized baseline of Sec groups.

Example: User is a Foreman so they are joined to Security Group Foreman which has other nested security groups.

Gary M G:

Eric-Schroeder:

That would be more like nested groups. Is that what you mean?

Hi Eric,
Can be nested groups, can be many different groups.
However, the basis is a User’s OU defines which groups they belong to.
So, my code basically does:

If UserA is in OU=A,DC=contoso.com, then add them to the following Security Groups → List of groups.

Now, for simplicity sake, I am using IGDLA (see Nested Group BP ) so Gobal Groups end up being added to Domain Local Security Groups.
The beauty of this is the code removes users and groups which don’t belong and obviates the need to manage group membership manually.

The downside is the rules must be strictly maintained and, as I said, the source CSV file is ugly as can be.

Those are tied into automated licensing of their mailbox E3’s and so on. We have that part but the script is just to be able to run and fill in that first piece and once they are in those groups the rest of my automation starts.

eric-schroeder · 2021-11-11T14:50:39.000Z

Eric-Schroeder:

AdmiralKirk:

Eric-Schroeder:

That is just for the actual Boxed Window correct?

The coordinates in question are for the list box (dropdown list) that has the Departments in it.

I’m sorry but I still don’t understand what you mean by coordinates. Are we talking about the DN location in AD? The actual box coordinates on the screen? As I said, I am more familiar with AD then I am programming or creating script to make list/dropdowns and such.

From my research these params are the drawing of the ACTUAL box. Like so:

# Add text box to enter the Department
    $DepartmentTextBox = New-Object System.Windows.Forms.ComboBox
    $DepartmentTextBox.Location = New-Object System.Drawing.Point(10,40)
    $DepartmentTextBox.Size = New-Object System.Drawing.Size(260,20)
    [void] $DepartmentTextBox.Items.Add("") <# put a blank at the top of the list #>
    <# Pull the department list and populate into the listbox #>
    foreach ($Dept in Get-ADUser -filter " Department -Like '*'" -Properties Department | Select-Object Department | Sort-Object Department -Unique) {
        [void] $DepartmentTextBox.Items.Add($Dept)
    }
    $DepartmentTextBox.DisplayMember = "Department"

AdmiralKirk · 2021-11-11T14:53:25.000Z

Eric-Schroeder:

AdmiralKirk:

Eric-Schroeder:

That is just for the actual Boxed Window correct?

The coordinates in question are for the list box (dropdown list) that has the Departments in it.

I’m sorry but I still don’t understand what you mean by coordinates. Are we talking about the DN location in AD? The actual box coordinates on the screen? As I said, I am more familiar with AD then I am programming or creating script to make list/dropdowns and such.

We should make sure we are on the same page here, otherwise we will be talking in disconnected circles and both be confused. I had it in my head that you are displaying a form on the screen with some boxes into which the user of the form will input the various data points you outlined. It was upon that premise that I suggested adding another object to said form.

For reference here is the relevant portion of my form:

If this is not how you are approaching your solution, could you describe and/or post an image of what you are doing?

@eric-schroeder

eric-schroeder · 2021-11-12T21:34:00.000Z

Ah so I was just starting to create Form boxes or should I say try and figure out how to make them and also how to make one with a dropdown so I didn’t have anything built out at all as I was way behind what your showing in the pic but that seems awesome!

What I did what just create a From box pop up for the certain inputs I needed but putting them into one seems cool also! I hadn’t thought of that nor would I know where to start. Just for record in case someone is in the same position my dropdown box is written like this:

#Dropdown box for Sec group script
[array]$DropDownArrayItems = (Get-ADGroup -Filter * -Properties Name).NAME
[array]$DropDownArray = $DropDownArrayItems | sort

# This Function Returns the Selected Value and Closes the Form

function Return-DropDown {
    if ($DropDown.SelectedItem -eq $null){
        $DropDown.SelectedItem = $DropDown.Items[0]
        $script:Choice = $DropDown.SelectedItem.ToString()
        $Form.Close()
    }
    else{
        $script:Choice = $DropDown.SelectedItem.ToString()
        $Form.Close()
    }
}

function SelectGroup{
    [void] [System.Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms")
    [void] [System.Reflection.Assembly]::LoadWithPartialName("System.Drawing")

    $Form = New-Object System.Windows.Forms.Form

    $Form.width = 300
    $Form.height = 150
    $Form.Text = ”DropDown”
    $Form.StartPosition = 'CenterScreen'

    $DropDown = new-object System.Windows.Forms.ComboBox
    $DropDown.Location = new-object System.Drawing.Size(100,10)
    $DropDown.Size = new-object System.Drawing.Size(130,30)

    ForEach ($Item in $DropDownArray) {
     [void] $DropDown.Items.Add($Item)
    }

    $Form.Controls.Add($DropDown)

    $DropDownLabel = new-object System.Windows.Forms.Label
    $DropDownLabel.Location = new-object System.Drawing.Size(10,10) 
    $DropDownLabel.size = new-object System.Drawing.Size(100,40) 
    $DropDownLabel.Text = "Select Group:"
    $Form.Controls.Add($DropDownLabel)

    $Button = new-object System.Windows.Forms.Button
    $Button.Location = new-object System.Drawing.Size(100,50)
    $Button.Size = new-object System.Drawing.Size(100,20)
    $Button.Text = "Select an Item"
    $Button.Add_Click({Return-DropDown})
    $form.Controls.Add($Button)
    $form.ControlBox = $false

    $Form.Add_Shown({$Form.Activate()})
    [void] $Form.ShowDialog()

    return $script:choice
}

$Group = $null
$Group = SelectGroup
while ($Group -like ""){
    $Group = SelectGroup
}

eric-schroeder · 2021-11-19T22:33:26.000Z

So now there seems to be another issue. I have finished the Dropdown box and it grabs all the Sec groups but if I just select the blank box option, meaning I do not need to add this user to any of those specific groups and want to basically check none it will take the first group in the list. (The top group that’s listed in alphabetical order). How do I get it to not select that if I just want to sort of bypass this group prompt?

#Dropdown box for Sec group script
[array]$DropDownArrayItems = (Get-ADGroup -Filter * -Properties Name).NAME
[array]$DropDownArray = $DropDownArrayItems | sort

# This Function Returns the Selected Value and Closes the Form

function Return-DropDown {
    if ($DropDown.SelectedItem -eq $null){
        $DropDown.SelectedItem = $DropDown.Items[0]
        $script:Choice = $DropDown.SelectedItem.ToString()
        $Form.Close()
    }
    else{
        $script:Choice = $DropDown.SelectedItem.ToString()
        $Form.Close()
    }
}

function SelectGroup{
    [void] [System.Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms")
    [void] [System.Reflection.Assembly]::LoadWithPartialName("System.Drawing")

    $Form = New-Object System.Windows.Forms.Form

    $Form.width = 300
    $Form.height = 150
    $Form.Text = ”DropDown”
    $Form.StartPosition = 'CenterScreen'

    $DropDown = new-object System.Windows.Forms.ComboBox
    $DropDown.Location = new-object System.Drawing.Size(100,10)
    $DropDown.Size = new-object System.Drawing.Size(130,30)

    ForEach ($Item in $DropDownArray) {
     [void] $DropDown.Items.Add($Item)
    }

    $Form.Controls.Add($DropDown)

    $DropDownLabel = new-object System.Windows.Forms.Label
    $DropDownLabel.Location = new-object System.Drawing.Size(10,10) 
    $DropDownLabel.size = new-object System.Drawing.Size(100,40) 
    $DropDownLabel.Text = "Select Group:"
    $Form.Controls.Add($DropDownLabel)

    $Button = new-object System.Windows.Forms.Button
    $Button.Location = new-object System.Drawing.Size(100,50)
    $Button.Size = new-object System.Drawing.Size(100,20)
    $Button.Text = "Select an Item"
    $Button.Add_Click({Return-DropDown})
    $form.Controls.Add($Button)
    $form.ControlBox = $false

    $Form.Add_Shown({$Form.Activate()})
    [void] $Form.ShowDialog()

    return $script:choice
}

$Group = $null
$Group = SelectGroup
while ($Group -like ""){
    $Group = SelectGroup
}

AdmiralKirk · 2021-11-24T00:54:23.000Z

To put a blank entry at the top of the dropdown list, add a blank/empty value to it before you populated it with your get-adgroup query:

[array]$DropDownArrayItems.Items.Add("")

This makes the first entry blank so you have to interact with the list before anything will happen. It should return a blank/empty value if nothing was selected.

@eric-schroeder

eric-schroeder · 2021-12-01T16:33:05.000Z

AdmiralKirk:

To put a blank entry at the top of the dropdown list, add a blank/empty value to it before you populated it with your get-adgroup query:
[array]$DropDownArrayItems.Items.Add("")
This makes the first entry blank so you have to interact with the list before anything will happen. It should return a blank/empty value if nothing was selected.

When I add that in the line right before the Get-Query I get this error:

You cannot call a method on a null-valued expression.
At C:\Users\Eric.Admin\Desktop\OnboardingScript-Initial.ps1:147 char:1

[array]$DropDownArrayItems.Items.Add(“”)
CategoryInfo : InvalidOperation: ( , RuntimeException
FullyQualifiedErrorId : InvokeMethodOnNull

AdmiralKirk · 2021-12-01T21:06:31.000Z

It seems like the problem is timing. What I think is happening is you are attempting to add an item to a variable before instantiating said variable.

Let’s try this:

#Dropdown box for Sec group script
$DropDownArrayItems = @("")
$DropDownArrayItems += (Get-ADGroup -Filter * -Properties Name).Name | Sort

# This Function Returns the Selected Value and Closes the Form

In my test with these two lines of code I got the results I expected: a blank followed by an alphabetical list of my filtered groups. We could squeeze this into a single line of code but it would be a little ugly and hard to read, so I’m happy with this two line approach.

The logic here is that we first create the array variable and its first entry is blank. Next you leverage the power of the pipeline to both retrieve your list of groups and sort them at the same time. Lastly, the results of that entire pipeline are appended to the original array variable.

*A word of caution: the += is okay for small tasks like this, but if you are doing manipulation of large arrays or multiple adds, you would want to use a different approach. See this StackOverflow article for more details powershell - Array.Add vs += - Stack Overflow

@eric-schroeder