script for  AD groups

arasumane · 2020-04-24T15:32:16.000Z

I was looking for script which can perform AD groups which are nested more than 1 level.(need to flatten AD groups up to level1)

Found below script which does complete of groups. following level2, level3, level4, level 5, level6 should be but level 1 nesting should be as it is

# Specify the DistinguishedName (DN) of the parent group. 

# We will remove all members of this group that have class "group". 

$GroupDN = "cn=Sales,ou=North,dc=domain,dc=com" 

# The Member property is an array of the DistinguishedNames (DN) of all direct members of the group. # The DN is required by Get-ADObject, which we use to determine the class of each member. $Members = (Get-ADGroup -Identity $GroupDN -Properties Member).Member 

 # Create an array of distinguished names of nested groups to remove. 

$GroupsToRemove = @() 

 # Enumerate all direct members of the parent group and determine which are nested groups. 

ForEach ($Member In $Members) 

{ 

 # Members can be users, computers, contacts, or nested groups. We only consider groups. 

 $Class = (Get-ADOject -Identity $Member).ObjectClass If ($Class -eq "group") { 

 # Add the DN of this nested group to the array of groups to remove. 

 $GroupsToRemove = $GroupsToRemove + $Member 

 } 

} 

 # Remove any nested groups from the parent group. 

If ($GroupsToRemove.Count -gt 0) 

{ 

Set-ADGroup -Identity $GroupDN -Remove @{Member=$GroupsToRemove

} 

}

Neally · 2020-04-24T16:02:15.000Z

If you post code, please use the ‘Insert Code’ button. Please and thank you!

PLEASE READ BEFORE POSTING! Read if you're new to the PowerShell forum! Programming & Development

Hi, and welcome to the PowerShell forum! Don’t apologize for being a “noob” or “newbie” or “n00b.” There’s just no need – nobody will think you’re stupid, and the forums are all about asking questions. Just ask! Use a descriptive subject. Don’t say “Need help” or “PowerShell Help”, actually summarize what the problem is. It helps the rest of us keep track of which problem is which. Don’t post massive scripts. We’re all volunteers and we don’t have time to read all that, nor will we copy…

semicolon · 2020-04-24T16:28:25.000Z

May I ask why? I’m merely curious as to the requirement,snd not intending to derail your thinking or show disrespect.

arasumane · 2020-04-24T17:29:12.000Z

As you know nested is good for global groups having large number users to domain local groups. so here we need to retain 1 level nesting for this purpose. Rest of the nesting is not a good practise or its difficult to analyze users exact access. hence we need to denest all other level of nesting of AD groups