Group membership

Question

Hi All

The following script doesn't work for AD groups. Members of ADGroup1 should be able to add or remove users from other AD Group. please guide me.

# Define the $owner that will be able to manage the members of $group
 $owner = "ADGroup1";
 $group = "AnyADGroup";
     
 # Try to get objects from AD            
 try {
     
     $ownerobject = get-aduser $owner;
     $groupobject = get-adgroup $group;
     
 # If AD could not be read
 } catch {
     
     write-host "Could not get user/group information from Active Directory";
     break;
 }
     
 # Try to set "write members" rights on the group 
 try {
     $ldapstring = "LDAP://" + $groupobject.distinguishedname;
     $ldapgroup = [ADSI]$ldapstring;
     
     [System.DirectoryServices.DirectoryEntryConfiguration]$secoptions = $ldapgroup.get_Options();
     $secoptions.SecurityMasks = [System.DirectoryServices.SecurityMasks]'Dacl';
        
     # Get SID
     $identityref = $ownerobject.sid.value;
     $sid = new-object System.Security.Principal.SecurityIdentifier ($identityref);
     
     # Define rights to be applied
     $adrights = [System.DirectoryServices.ActiveDirectoryRights]::WriteProperty;
     $type = [System.Security.AccessControl.AccessControlType]::Allow;
     
     # Define permission attribute to modify (writeMembers)
     $objectguid = [Guid]"bf9679c0-0de6-11d0-a285-00aa003049e2";
     
     $adrule = new-object System.DirectoryServices.ActiveDirectoryAccessRule ($sid, $adrights, $type, $objectguid);
     
     # Apply new ACL
     $ldapgroup.get_ObjectSecurity().AddAccessRule($adrule);
     $ldapgroup.CommitChanges();
     
     write-host ("ACLs updated for group: " + $group);
     
     
 # If permissions could not be set
 } catch {
     
     write-host ("Could not set new ACLs on group: " + $group);
     break;
 }

Answer 1

when i put $owner = "user1", it works fine

If $owner contains a group name, then call get-adgroup and not get-aduser.

$owner = "ADGroup1"; 
$ownerobject = get-adgroup $owner;

Answer 2

i am getting the below error for AD groups. The above scripts works for individual users for example when i put $owner = "user1", it works fine

Could not get user/group information from Active Directory

Answer 3

by make the below change it worked, i am unable to mark answer to this post.

$owner = "ADGroup1";

$ownerobject = get-adgroup $owner;