Menu

Virtual Geek

Tales from real IT system administrators world and non-production environment

PowerShell: Copy group membership from one user to another user in Active Directory

In the past, I received multiple emails asking for a script, subject was copying group membership from one user to another user in AD. I thought of writing a reusable script code and so anyone can and use it. Copy groups membership from one user to another user tasks can be lengthy and takes lots of time, to ease this scripts helps you within a few seconds to accomplish task without any error.

Check out my earlier script on using Active directory Powershell.
POWERSHELL ACTIVE DIRECTORY: ADD OR UPDATE (CHANGE) MANAGER NAME IN ORGANIZATION TAB OF USER
Add multiple proxy addresses with Microsoft PowerShell in Active Directory Groups 

To execute script the prerequisite is ActiveDirectory powershell module should be installed, Use either RSAT on client OS or install server manager feature AD Tools on Server OS. For demo purpose I want to copy groups from Administrator user to other bulk Active Directory users. For a demo I have opened properties for Source and Destination user. And need to copy Administrator user member of groups to another user member of tab.

active directory, activedirectory module, copy-adgroupmembership, user properties, active directory domain services, member of tab, add group, powershell ad, domain controller, forest, copy clone member of group membership.png

There are 2 parameter Copy-AdGroupMemberShip.ps1, before running script make sure you have access to Active directory to make changes or it will show error message Insufficient access rights to perform the operation.

.\Copy-AdGroupMemberShip.ps1 -SourceUser <Source User> -DestinationUsers <User1>, <User2>, <User3>

active directory, activedirectory module, copy-adgroupmembership, powershell ad, domain controller, forest, copy clone member of group membership.png

Parameters are as below.
-SourceUser: This is source Ad user parameter, It is a name whose group membership need to be copied to another user.
-DestinationUsers: In this parameter provide username where you want to clone group members (for list of multiple users use comma to separate them, for more details check help)

powershell pwsh, active directory module, ad, domain controller, domain services, copy clone ad group membership member of to another user get-aduser, Add-ADGroupMember .png

After executing script, It validates user from the lists first. if AdUser doesn't exist it will skip that user. After running the script successfully, that shows onscreen logs. Also
Result can be reviewed on user properties, Member of groups are copied from one user to another.

Download this script from github.com, it is also available here.

powershell pwsh, active directory module, ad, domain controller services dc, ad domain services folder, copy clone ad group membership member of to another aduser cmdletbinding get-aduser, Add-ADGroupMembe.png

Other version of this script: PowerShell GUI: Copy group membership from one user to another user in Active Directory and PowerShell Active Directory: Sync group membership from one user to another user and move to OU

Script

<#  
    .Synopsis  
    Copy or clone source user's member of group to another user, Copy group membership from one user to another in Active Directory.
    .Description  
    Run this script on domain controller, or install RSAT tool on your client machine. This will copy existing given users group to other give group. It validates and verify whether Source and Destination users exists or you have access.
    .Example  
    .\Copy-AdGroupMemberShip.ps1 -SourceUserGroup Administrator -DestinationUsers user1, user2, user3
        
    It takes provided Source user, note down which groups it is member of. Add same groups in the member of tabs of users list provided in parameter DestinationUsers.
    .Example
    .\Copy-AdGroupMemberShip.ps1 -SourceUser Administrator -DestinationUsers (Get-Content C:\Userlist.txt)

    Users list can be provided into text file.
    .Example
    user1, user2, user3 | .\Copy-AdGroupMemberShip.ps1 -SourceUser Administrator

    .Notes
    NAME: Copy-AdGroupMemberShip
    AUTHOR: Kunal Udapi
    CREATIONDATE: 3 February 2019
    LASTEDIT: 4 February 2019
    KEYWORDS: Copy or clone source user's member of group to another user.
    .Link  
    #Check Online version: http://kunaludapi.blogspot.com
    #Check Online version: http://vcloud-lab.com
    #Requires -Version 3.0  
    #>  
#requires -Version 3   
[CmdletBinding()]
param
(  
    [Parameter(Mandatory=$true,ValueFromPipeline=$True,ValueFromPipelineByPropertyName=$true)]
    [alias('DestUser')]
    [String[]]$DestinationUsers,
    [String]$SourceUserGroup = 'Administrator') #param
Begin 
{  
    Import-Module ActiveDirectory
} #Begin

Process 
{
    try 
    {
        $sourceUserMemberOf = Get-AdUser $SourceUserGroup -Properties MemberOf -ErrorAction Stop
    }
    catch 
    {
        Write-Host -BackgroundColor DarkRed -ForegroundColor White $Error[0].Exception.Message
        Break
    }
    
    #$destinationUser = @('TestUser','vKunal','Test','TestUser1','Test2')
    $DestinationUser = [System.Collections.ArrayList]$DestinationUsers
    
    $confirmedUserList = @()
    foreach ($user in $destinationUser) 
    {
        try 
        {
            Write-Host -BackgroundColor DarkGray "Checking user '$user' status in AD..." -NoNewline
            [void](Get-ADUser $user -ErrorAction Stop)
            Write-Host -BackgroundColor DarkGreen -ForegroundColor White "...Tested user '$user' exist in AD"
            $confirmedUserList += $user
        }
        catch [Microsoft.ActiveDirectory.Management.ADIdentityNotFoundException]
        {
            Write-Host -BackgroundColor DarkRed -ForegroundColor White "...User '$user' doesn't exist in AD"
            
        } #catch [Microsoft.ActiveDirectory.Management.ADIdentityNotFoundException]
        catch 
        {
            Write-Host -BackgroundColor DarkRed -ForegroundColor White "...Check your access"
        } #catch
    } #foreach ($user in $destinationUser)
    
    Write-host "`n"
    
    foreach ($group in $sourceUserMemberOf.MemberOf) 
    {
        try 
        {
            $groupInfo = Get-AdGroup $group 
            $groupName = $groupInfo.Name
            $groupInfo | Add-ADGroupMember -Members $confirmedUserList -ErrorAction Stop
            Write-Host -BackgroundColor DarkGreen "Added destination users to group '$groupName'"
        } #try

        catch
        {
            #$Error[0].Exception.GetType().fullname
            if ($null -eq $confirmedUserList[0]) {
                Write-Host -BackgroundColor DarkMagenta "Provided destination user list is invalid, Please Try again."
                break
            }
            Write-Host -BackgroundColor DarkMagenta $groupName - $($Error[0].Exception.Message)
        } #catch
    } #foreach ($group in $sourceUserMemberOf.MemberOf) 
} #Process
end {}

Useful Articles
GUI - SETUP AND CONFIGURE POWERSHELL WEB ACCESS SERVER (GATEWAY)
USE POWERSHELL ON MOBILE - SETUP AND CONFIGURE POWERSHELL WEB ACCESS (PSWA)
Powershell Trick : Execute or run any file as a script file
Set Powershell execution policy with Group Policy
Powershell execution policy setting is overridden by a policy defined at a more specific scope

Go Back



Comment

Blog Search

Page Views

12056150

Follow me on Blogarama