AD users not is a particular security group

Question

I'm trying to get a list of all the users that have logged on in the last 60 days and are not in a particular security group.
Using a couple of other scripts i can get the number of users that have logged on and the number of members is the SG, But i need to know the who is not a member of the Sg as its for 365 licencing.

Running this gives me the list of all the users logged on in the last 60 days, so it works.
$OU = "DC=Domain,DC=com"
Get-ADUser -Filter * -SearchBase $OU -Properties Name,SamAccountName,LastLogonDate,DistinguishedName, memberOf |
Where-Object {($_.LastLogonDate -ge (Get-Date).AddDays(-60))

When I add this is exports users that are in the SG and some that aren't

-and ($_.memberOf -NotLike "GroupName") } | export-csv "C:\temp\userexport.csv"

Full Script:

$OU = "DC=Domain,DC=com"
Get-ADUser -Filter * -SearchBase $OU -Properties Name,SamAccountName,LastLogonDate,DistinguishedName, memberOf | 
Where-Object {($_.LastLogonDate -ge (Get-Date).AddDays(-60)) -and ($_.memberOf -NotLike "GroupName") } | export-csv "C:\temp\userexport.csv"

Answer 1

Try this:

$OU = "DC=Domain,DC=com"
$dn = (Get-ADGroup "GroupName").distinguishedName
Get-ADUser -Filter * -SearchBase $OU -Properties Name,SamAccountName,LastLogonDate,DistinguishedName, memberOf | 
    Where-Object {($_.LastLogonDate -ge (Get-Date).AddDays(-60)) -and ($_.memberOf -notcontains $dn) } | 
        Select-Object Name,SamAccountName,LastLogonDate,DistinguishedName |
            export-csv "C:\temp\userexport.csv" -NoTypeInformation

If you have more than one domain controller in the domain "domain.com" you're going to get results that aren't entirely accurate because your using LastLogonDate, and that's a locally (i.e. per DC) "calculated" value of the LastLogonTimeStamp. To be entirely accurate you'll have to query each DC for each user for the user's "LastLogon" value. You'll then keep just the most recent date from among them.

Here's a good reference (there are many more!): lastlogon-vs-lastlogontimestamp-vs.html

Answer 2

Hello,

Try DN instead of Group name. it will work.
($_.memberOf -NotLike "GroupName")

if you want to use groupname then convert DN to Group name then do validation.

Let me know the status.

Answer 3

See if this works for you:

$OU = "DC=Domain,DC=com"
$groups = "a","b","c"
[array]$dns =   $groups |
                    ForEach-Object{
                        $dns += (Get-ADGroup $_).DistinguishedName
                    }
Get-ADUser -Filter * -SearchBase $OU -Properties Name,SamAccountName,LastLogonDate,DistinguishedName, memberOf | 
    Where-Object {($_.LastLogonDate -ge (Get-Date).AddDays(-60))} |
        ForEach-Object{
            $exportuser = $true
            foreach ($dn in $dns){
                if ($_.memberof -contains $dn){       # user is a member of at least one group
                    $exportuser = $false
                    break
                }
            }
            if ($exportuser){
                $_                                  # emit user
            }
    } | Select-Object Name,SamAccountName,LastLogonDate,DistinguishedName |
            export-csv "C:\temp\userexport.csv" -NoTypeInformation

Answer 4

Hello @lee roberts

Additionally you may try this powershell command which uses LDAP filter

Get-ADUsers -LDAPFilter "(&(!memberOf=cn=Group1,ou=myOU,dc=MyDomain,dc=com)(!memberOf=cn=Group2,ou=MyOU,dc=MyDomain,dc=com)(!memberOf=cn=Group3,ou=MyOU,dc=MyDomain,dc=com))"  

You must specify the DN of groups.

Thank you.