Copy User Automatically from One AD Group to Another.

Question

When a user is added to one on-prem AD security group, make it so they are automatically added to another on-prem AD security group. Is this possible? I'm trying to make it so the Accounts team doesn't have to remember to add a user to 2 AD groups. I'm also trying to do this for new users onwards. Thanks!

Answer 1

Do you have auditing enabled in the domain? There should be an event in the security eventlog when a user gets added to a group. You should be able to attach a task to the event and write a script to add the user to whatever groups you want.

https://adamtheautomator.com/audit-group-membership-changes-active-directory/

https://www.bing.com/search?q=attach%20a%20task%20to%20a%20windows%20event%20powershell

Sorry, I no longer have access to an AD environment to test with.

Answer 2

Maybe nesting the groups will solve it.

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 3

There's nothing native for this. The simplest solution may be to use PowerShell. Some ideas here.
https://community.spiceworks.com/topic/2128061-powershell-adding-a-single-user-to-multiple-groups

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 4

Hello @MCcorpNow

I can understand that you need to Add user to some AD Groups after they have been created. In case some one forgot to add.

You can achieve this using two approaches.

Method 1 :
You can use below PowerShell which will get List off AD groups created before 1 or 2 days. and If found add them to groups.
You can put this script in Task scheduler to run every day to be run Automatically.

$DateCutOff=(Get-Date).AddDays(-1)  
#^ This will take today’s date and effectively add -1 days to it.  
Get-ADUser -Filter {whenCreated -gt $datecutoff} |Foreach{Add-ADGroupMember -Identity "GroupNAME" -Member $_}  

Method 2:
Create a default user template empty AD account with necessary group in the members tab .
You copy this when creating a new user it should work.

To copy an Active Directory domain user account, open the Active Directory Users and Computers MMC snap-in, right click the user object and select “Copy” from the context menu.

Hope this answers your query :)

----------------------------------------------------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept as answer--