normand - my spot on technet

Consuming the POST request data from EMIE for Internet Explorer 11

Norman Drews — Tue, 02 Dec 2014 11:09:03 GMT

Everyone should know by now that come January 12, 2016 Microsoft will provide limited support for browser versions earlier than 11. That means Enterprise customers should really consider upgrading to version 11. The above link will show you the support versions.

I'm assuming you are well on your way to setting up your group policy objects to push out the following policies:

This post will focus on how to better consume what goes in text box below…. It is the policy above. If you don't see any of these options make sure you've installed the latest Internet Explorer onto the server or retrieve the templates from here.

Enterprise Mode for Internet Explorer will send a POST request to pretty much anything that can accept it. Most examples show a simple POST and reference to a web server. In this case you just need to look up the entry in the IIS log file and voila there you have it.

My problem is that, even with a handy tool such as the old-school Log Parser, while you can get the results, it isn't a nice format. I'd rather store the data inside of a database.

Follow these steps in any order you want… It is the end result that really matters….

Step One – Configure SQL Server

I'm using SQL Server 2012, but any recent one should work without a problem. You should ask your DBA if you are uncertain as to managing your SQL Server. We need to create a database, table, and stored procedure

Database Creation Script

USE [master]
GO

/****** Object:  Database [EMReporting]    Script Date: 11/26/2014 2:54:09 PM ******/
CREATE DATABASE [EMReporting]
 CONTAINMENT = NONE
 ON  PRIMARY 
( NAME = N'EMReporting', 
FILENAME = N'C:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\EMReporting.mdf' , 
SIZE = 4096KB , MAXSIZE = UNLIMITED, FILEGROWTH = 1024KB )
 LOG ON 
( NAME = N'EMReporting_log', 
FILENAME = N'C:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\EMReporting_log.ldf' , 
SIZE = 1024KB , MAXSIZE = 2048GB , FILEGROWTH = 10%)
GO

ALTER DATABASE [EMReporting] SET COMPATIBILITY_LEVEL = 110
GO

IF (1 = FULLTEXTSERVICEPROPERTY('IsFullTextInstalled'))
begin
EXEC [EMReporting].[dbo].[sp_fulltext_database] @action = 'enable'
end
GO

ALTER DATABASE [EMReporting] SET ANSI_NULL_DEFAULT OFF 
GO

ALTER DATABASE [EMReporting] SET ANSI_NULLS OFF 
GO

ALTER DATABASE [EMReporting] SET ANSI_PADDING OFF 
GO

ALTER DATABASE [EMReporting] SET ANSI_WARNINGS OFF 
GO

ALTER DATABASE [EMReporting] SET ARITHABORT OFF 
GO

ALTER DATABASE [EMReporting] SET AUTO_CLOSE OFF 
GO

ALTER DATABASE [EMReporting] SET AUTO_CREATE_STATISTICS ON 
GO

ALTER DATABASE [EMReporting] SET AUTO_SHRINK OFF 
GO

ALTER DATABASE [EMReporting] SET AUTO_UPDATE_STATISTICS ON 
GO

ALTER DATABASE [EMReporting] SET CURSOR_CLOSE_ON_COMMIT OFF 
GO

ALTER DATABASE [EMReporting] SET CURSOR_DEFAULT  GLOBAL 
GO

ALTER DATABASE [EMReporting] SET CONCAT_NULL_YIELDS_NULL OFF 
GO

ALTER DATABASE [EMReporting] SET NUMERIC_ROUNDABORT OFF 
GO

ALTER DATABASE [EMReporting] SET QUOTED_IDENTIFIER OFF 
GO

ALTER DATABASE [EMReporting] SET RECURSIVE_TRIGGERS OFF 
GO

ALTER DATABASE [EMReporting] SET  DISABLE_BROKER 
GO

ALTER DATABASE [EMReporting] SET AUTO_UPDATE_STATISTICS_ASYNC OFF 
GO

ALTER DATABASE [EMReporting] SET DATE_CORRELATION_OPTIMIZATION OFF 
GO

ALTER DATABASE [EMReporting] SET TRUSTWORTHY OFF 
GO

ALTER DATABASE [EMReporting] SET ALLOW_SNAPSHOT_ISOLATION OFF 
GO

ALTER DATABASE [EMReporting] SET PARAMETERIZATION SIMPLE 
GO

ALTER DATABASE [EMReporting] SET READ_COMMITTED_SNAPSHOT OFF 
GO

ALTER DATABASE [EMReporting] SET HONOR_BROKER_PRIORITY OFF 
GO

ALTER DATABASE [EMReporting] SET RECOVERY FULL 
GO

ALTER DATABASE [EMReporting] SET  MULTI_USER 
GO

ALTER DATABASE [EMReporting] SET PAGE_VERIFY CHECKSUM  
GO

ALTER DATABASE [EMReporting] SET DB_CHAINING OFF 
GO

ALTER DATABASE [EMReporting] SET FILESTREAM( NON_TRANSACTED_ACCESS = OFF ) 
GO

ALTER DATABASE [EMReporting] SET TARGET_RECOVERY_TIME = 0 SECONDS 
GO

ALTER DATABASE [EMReporting] SET  READ_WRITE 
GO

Table Creation Script

USE [EMReporting]
GO

/****** Object:  Table [dbo].[EMIntervention]    Script Date: 11/26/2014 2:54:52 PM ******/
SET ANSI_NULLS ON
GO

SET QUOTED_IDENTIFIER ON
GO

CREATE TABLE [dbo].[EMIntervention](
    [Id] [int] IDENTITY(1,1) NOT NULL,
    [status] [nchar](3) NULL,
    [referrer] [nvarchar](max) NULL,
    [username] [nvarchar](50) NULL,
    [ipaddress] [nvarchar](50) NULL,
    [timestamp] [datetime] NULL,
 CONSTRAINT [PK_EMIntervention] PRIMARY KEY CLUSTERED 
(
    [Id] ASC
)WITH (PAD_INDEX = OFF, STATISTICS_NORECOMPUTE = OFF, IGNORE_DUP_KEY = OFF, ALLOW_ROW_LOCKS = ON, ALLOW_PAGE_LOCKS = ON) 
ON [PRIMARY]
) ON [PRIMARY] TEXTIMAGE_ON [PRIMARY]

GO

Stored Procedure Creation Script

USE [EMReporting]
GO

/****** Object:  StoredProcedure [dbo].[InsertIntoTable]    Script Date: 11/26/2014 2:55:17 PM ******/
SET ANSI_NULLS ON
GO

SET QUOTED_IDENTIFIER ON
GO


CREATE PROCEDURE [dbo].[InsertIntoTable]
(
    @status nchar(3) = NULL,
    @referrer nvarchar(MAX) = NULL,
    @username nvarchar(50) = NULL,
    @ipaddress nvarchar(50) = NULL,
    @timestamp datetime
)
AS
    SET NOCOUNT OFF;
INSERT INTO [EMIntervention] ([status], [referrer], [username], [ipaddress], [timestamp]) 
VALUES (@status, @referrer, @username, @ipaddress, @timestamp);
GO

Step Two – Configure IIS and push below code to web server

IIS Configuration

You should be able to get away with using mostly default settings when you create a new web site. Just ensure these key three things:

1) Disable all authentication (Features View of the site) except for Windows Authentication. Keep it enabled.

2) Ensure the application pool supports the 4. NET Framework.

3) Create firewall exception if you are using a non-default port in the binding. Above I'm pointing to port 8088.

Web Application

The below was written with Visual Studio 2012 (Update 4).

1) Create an empty ASP.Net Web application.

2) Add a new WebForm (mine is called Post.aspx). In the code behind, this is what I wrote inside of the partial class…

   1:  public struct DataBlock

   2:  {

   3:      public DateTime timestamp { get; set; }

   4:      public string referrer { get; set; }

   5:      public string user { get; set; }

   6:      public string ipaddress { get; set; }

   7:      public string status { get; set; }

   8:  }

9:

  10:  protected string GetIPAddress()

  11:  {

  12:      System.Web.HttpContext context = System.Web.HttpContext.Current;

  13:      string ipAddress = context.Request.ServerVariables["HTTP_X_FORWARDED_FOR"];

14:

  15:      if (!string.IsNullOrEmpty(ipAddress))

  16:      {

  17:          string[] addresses = ipAddress.Split(',');

  18:          if (addresses.Length != 0)

  19:          {

  20:              return addresses[0];

  21:          }

  22:      }

23:

  24:      return context.Request.ServerVariables["REMOTE_ADDR"];

  25:  }

26:

27:

  28:  protected void Page_Load(object sender, EventArgs e)

  29:  {

  30:      DataBlock datablock = new DataBlock();

31:

  32:      datablock.timestamp = HttpContext.Current.Timestamp;

  33:      datablock.referrer = Request.Form["URL"];

  34:      datablock.status = Request.Form["EnterpriseMode"];

  35:      datablock.user = Request.LogonUserIdentity.Name;

  36:      datablock.ipaddress = GetIPAddress();

37:

  38:      WriteToSqlServer(datablock);

  39:  }

40:

  41:  private void WriteToSqlServer(DataBlock datablock)

  42:  {

  43:      string strConnection = ConfigurationManager.ConnectionStrings["EMReportingConnectionString"].ConnectionString;

  44:      using (SqlConnection connection = new SqlConnection(strConnection))

  45:      {

  46:          connection.Open();

  47:          using (SqlCommand command = new SqlCommand())

  48:          {

  49:              command.Connection = connection;

  50:              command.CommandType = CommandType.StoredProcedure;

  51:              command.CommandText = "dbo.InsertIntoTable";

  52:              command.Parameters.AddWithValue("@status", datablock.status);

  53:              command.Parameters.AddWithValue("@referrer", datablock.referrer);

  54:              command.Parameters.AddWithValue("@username", datablock.user);

  55:              command.Parameters.AddWithValue("@ipaddress", datablock.ipaddress);

  56:              command.Parameters.AddWithValue("@timestamp", datablock.timestamp);

  57:              command.ExecuteNonQuery();

  58:          }

  59:      }

  60:  }

Here's a breakdown:

Lines 1-8: I'm defining a structure for easier usage when passing as a parameter.

Line 10-25: It is a helper function that returns the client IP. You may want to modify it as you see fit. I'm not using a load balancer in my testing.

Lines 28-39: It is retrieving information about the request such as IP Address, timestamp, the user name (this is why we have windows authentication enabled) and two interesting ones: URL and EnterpriseMode. You can see these two items in the POST body. Below is a screenshot of a Fiddler Inspector called "TextView" from when a user turns off Enterprise Mode for a given site.

This information is really useful because the IT Admin can keep track of what sites individual users enabled/disabled (On/Off) Enterprise Mode against. The idea is to ultimately consolidate these findings into the Enterprise Mode Site List. That second policy definition further up in this post (https://SERVER01:8088/sites.xml) OR fix the sites you missed during the initial inventory process.

Lines 41-60: This code calls a stored procedure that writes the data neatly to a table… It assumes you have a stored procedure called "dbo.Insert". See Step One – Configure SQL Server.

3) Make sure that your project's web.config is pointing to the database. I'm using SQL Authentication since I defined a user that has access to the particular database/table. Here is what I am using inside of my web.config file.

1:

2:

   3:          "EMReportingConnectionString" connectionString="Data Source=sqlserver01;Initial Catalog=EMReporting;user id=EMUser;Password=[EnterPasswordHere]"

   4:              providerName="System.Data.SqlClient" />

5:

6:

   7:        "true" targetFramework="4.5" />

   8:        "4.5" />

9:

10:

11:

4. Deploy the application. I used the built in "Publish" mechanism from within Visual Studio. You just need to make sure the development and target machines have at least Web Deploy 3.5 installed.

End Result

If the code (Step Two) compiled and was deployed properly AND you've successfully created the database, table, and stored procedure (Step One) AND there is a group policy defining where to POST the end user action, you can now focus on the client.

When a client goes to a site and say it looks bad and decided to enable Enterprise Mode via Tools –> Enterprise Mode, EMIE will send a POST to your ASPX page which in turn sends the results via stored procedure into a SQL Table.

You go to the SQL Server and take a look and this is what you get:

The sample project and SQL scripts can be downloaded from here.

Where art thou my windows user???

Norman Drews — Wed, 05 Feb 2014 20:31:00 GMT

Scenario

Let's say you are a user logged into a bunch of machines and you suddenly get locked out? The problem is you don't remember all the machines where you are currently logged in! So you call into your company support line and there are a couple things you need them to:

Unlock your AD Account
Figure out what machines you are logged into

During this session, we are going to show a script example that the support personnel can use to find where you are. I began to think of approaches we could use. Some options include:

Combination of Win32_LogonSession and Win32_LoggedOnUser
Look for an explorer.exe process and grab the owner

The Idea

I want to keep the script as simple as possible and this isn't the only approach, but here is an example that will essentially enumerate thru a list of reachable (online) computers in ActiveDirectory and check process ownership of explorer.exe. The output is returned to the screen. Then, if we want, we can log the user out on their behalf.

The final script

   1:  Import-Module -Name ActiveDirectory

2:

   3:  $computers = Get-ADComputer -Filter * |

   4:      Select-Object -ExpandProperty Name

5:

   6:  $username = "Administrator"

7:

   8:  # This will return only reacheable machines and store

   9:  # just the destination address

10:

  11:  $params = @{

  12:      ComputerName = $computers

  13:      Count = 1

  14:      ErrorAction = "SilentlyContinue"

  15:  }

16:

  17:  $reacheable = Test-Connection @params |

  18:                  Select-Object -ExpandProperty Address

19:

  20:  $params = @{

  21:      Class = "Win32_Process"

  22:      ComputerName = $reacheable

  23:      Filter = "name = 'explorer.exe'"

  24:      Property = "Handle", "CSName"

  25:  }

26:

  27:  # Potentially time-consuming as there is no direct

  28:  # property to return a process owner so we're limited

  29:  # to local Where-Object filtering

30:

  31:  $userIsPresent = Get-WmiObject @params |

  32:                      Where-Object { $_.GetOwner().User -eq $username } |

  33:                          Select-Object -ExpandProperty csname

34:

  35:  "{0} is present on {1}" -f $username, $($userIsPresent -join ", ")

Let's break this out into pieces…

Lines 1-4: We load the ActiveDirectory module for our lone AD Query (Get-ADComputer). The module you can get via the RSAT tools. Click here for where to find them. If you don't like having a dependency on the AD Module for Windows PowerShell, you can use instead the System.DirectoryServices.DirectorySearcher .NET class to do our search for us.

Line 6: We specify a $username value for purposes of the script. To make it more useable, you can instead get the name from the user using the Read-Host cmdlet.

Line 11-18: We first check if the machines are online. The quickest way I can see is to use Test-Connection and have it return just the reachable machines. Now, if the machine is offline or unreachable (aka the plug pulled from the network) then there isn't much we can do about that. The online machines are then stored into a variable called $reacheable.

Line 20-33: This is the heavy lifting and potentially time-consuming component. We set up our parameters and pass it into the Get-WmiObject using a technique called splatting. Line 24 contains the bare minimum property list that we need for this to work. We could have returned all parameters but this is a tad more friendly on the network.

It basically makes it easier to read especially if we have a large number of parameters we are using. We check the result against our $username variable. There isn't a built-in property called Owner so what we do is call the GetOwner() method and that returned object has a User property. That is the property we compare against. We then send it further thru the pipeline where we return an array of the computer names we searched and evaluated to true in the Where-Object cmdlet.

Line 35: We wrap it up by outputting to the user what machines he/she is currently on.

Hope you find this useful…

FindTheUser.zip

Using FindExecutable - Finding the registered executable given a file path

Norman Drews — Fri, 22 Feb 2013 08:23:21 GMT

I had a need to find the registered executable for a particular file extension. Now, it is possible to determine this via the registry. You could figure it out by looking into HKEY_CLASSES_ROOT but that is sometimes a tedious exercise if you've multiple potential applications that can handle the file type. The route I chose was to make use of a native function called FindExecutable exposed by shell32.dll.

FindExecutable function (Windows)

https://msdn.microsoft.com/en-us/library/windows/desktop/bb776419(v=vs.85).aspx

Looks fun, right?

How do I incorporate this inside of my Windows PowerShell script?

It isn't too bad. Most people know that Windows PowerShell is built on top of the .NET Framework. Well, with the .NET Framework comes the ability to reference native or unmanaged code (above) using the Add-Type cmdlet. This is probably an under-utilized feature of Windows PowerShell because there are cmdlets for almost everything now. So all your C# and C++ code isn't completely useless! It can be re-used.

Add-Type cmdlet

Per the documentation, the Add-Type cmdlet lets you define a .NET Framework class in your Windows PowerShell session. You can then instantiate objects (by using the New-Object cmdlet) and use the objects, just as you would use any .NET Framework object. If you add an Add-Type command to your Windows PowerShell profile, the class will be available in all Windows PowerShell sessions.

You can specify the type by specifying an existing assembly or source code files, or you can specify the source code inline or saved in a variable. You can even specify only a method and Add-Type will define and generate the class. You can use this feature to make Platform Invoke (P/Invoke) calls to unmanaged functions in Windows PowerShell. If you specify source code, Add-Type compiles the specified source code and generates an in-memory assembly that contains the new .NET Framework types.

You can use the parameters of Add-Type to specify an alternate language and compiler (CSharp is the default), compiler options, assembly dependencies, the class namespace, the names of the type, and the resulting assembly.

The Code

$Source = @"

using System;
using System.Text;
using System.Runtime.InteropServices;
public class Win32API
    {
        [DllImport("shell32.dll", EntryPoint="FindExecutable")] 

        public static extern long FindExecutableA(string lpFile, string lpDirectory, StringBuilder lpResult);

        public static string FindExecutable(string pv_strFilename)
        {
            StringBuilder objResultBuffer = new StringBuilder(1024);
            long lngResult = 0;

            lngResult = FindExecutableA(pv_strFilename, string.Empty, objResultBuffer);

            if(lngResult >= 32)
            {
                return objResultBuffer.ToString();
            }

            return string.Format("Error: ({0})", lngResult);
        }
    }

"@

Add-Type -TypeDefinition $Source -ErrorAction SilentlyContinue

Get-ChildItem -Path D:\MyFolder | 
    Where-Object { -not $_.PSIsContainer } | 
            ForEach-Object {
                $FullName = $_.FullName
                $Executable = [Win32API]::FindExecutable($FullName)
                $OutputString = "`nFile: {0}`nExecutable: {1}" -f $FullName, $Executable
                Write-Host -Object $OutputString
  
            }

Disabling/Enabling Network Connection by Name

Norman Drews — Tue, 17 Jan 2012 11:29:04 GMT

I was playing around with Windows PowerShell today and wanted to demonstrate a way to disable a network connection by the name or any other property for that matter. This entry will be limited to filtering on the name. First the network connections I care about I have below on my local machine.

To get this listing we need to use the WMI class called Win32_NetworkAdapter. Without going into too much detail, that class represents a network adapter of a computer. The link gives more detail if you want to show IPv6 data. This is currently limited to IPv4 information.

Anyhow, to get a listing, I run this command:

Get-WmiObject -Class Win32_NetworkAdapter `
    -Filter "NetConnectionID IS NOT NULL" | 
   Format-Table -Property NetConnectionID, NetEnabled, InterfaceIndex `
    –AutoSize

After running that command I will get the following output for my box.

NetConnectionID               NetEnabled InterfaceIndex
---------------               ---------- --------------
Local Area Connection              False             10
Wireless Network Connection 6       True             25
Wireless Network Connection 7      False             26

Your output probably differs. We are closer to achieving our goal. That WMI class gives us a few method to play with:

Get-WmiObject -Class Win32_NetworkAdapter | 
    Get-Member -MemberType Method | 
        Format-Table -Property Name

TypeName: System.Management.ManagementObject#root\cimv2\Win32_NetworkAdapter

Name
----
Disable
Enable
Reset
SetPowerState

The WMI Class provides us with 4 methods that are usable if we run this script elevated. Remember, the act of modifying a network adapter requires elevated privileges.

To ENABLE a network adapter

$networkAdapterName = "Wireless Network Connection 7"
Get-WmiObject -Class Win32_NetworkAdapter `
    -Filter "NetConnectionID = '$($networkAdapterName)'" | 
        ForEach-Object { $_.Enable() }

To DISABLE a network adapter

$networkAdapterName = "Wireless Network Connection 7"
Get-WmiObject -Class Win32_NetworkAdapter `
    -Filter "NetConnectionID = '$($networkAdapterName)'" | 
        ForEach-Object { $_.Disable() }

Removing leaf objects from Active Directory

Norman Drews — Thu, 12 Jan 2012 07:58:36 GMT

Not recently I had a customer whose migration , one way or another, was being blocked due to leaf objects existing under an AD User entry. They said they couldn't find any script online through Google or Bing that they could "borrow". I'm not really an Active Directory guy but I like scripting so I took a stab at it.

In these scripts the usual suspects you may want to modify include but aren't limited to:

Search Root
(LDAP)Filters in case you don't want to remove the leaf objects underneath all users
User Output

The Script using AD Cmdlets

param
(
    $root = "ou=myTestOU,dc=contoso,dc=com"
)
# Import the AD Module
Import-Module ActiveDirectory
# Get all users using a provided searchbase.
$users = Get-ADUser -Filter * -SearchBase $root
# Loop through the users
foreach($user in $users)
{
    # Find all AD objects one level below the user
    $objs = Get-ADObject -Filter * -SearchScope `
    oneLevel -SearchBase $user.DistinguishedName
    
    # Performance a recursive delete to remove those leaf objects
    if($objs)
    {
        Write-Host "Removing leaf objects..."        
        $objs | Remove-ADObject -Recursive
    } 
}

The Script using direct .NET Framework access

param
(
    $root = "LDAP://ou=MyTestOU,dc=contoso,dc=com",
    $scope = "subtree",
    $LDAPFilter = "(&(objectcategory=User))"
)
# Set up the DirectorySearcher object
$s = New-Object -TypeName System.DirectoryServices.DirectorySearcher
$s.SearchRoot = [adsi]$root
$s.SearchScope = $scope
$s.Filter = $LDAPFilter
# Find all matches
$result = $s.FindAll()
# Enumerate through all matches
foreach ($item in $result)
{
    $entry = $item.GetDirectoryEntry()
    
    # Enumerate through the children and delete them
    foreach($obj in $entry.children)
    {
        "Deleting $($obj.DistinguishedName)"
        $leaf = [adsi]"LDAP://$($obj.DistinguishedName)"
        $leaf.psbase.DeleteTree()
    }
}

What’s the member delta between my two AD Groups

Norman Drews — Tue, 10 Jan 2012 14:15:00 GMT

Today I am going to refresh your memory on how we can use the Compare-Object cmdlet to do well exactly what it says …. compare two different objects.

So how do I determine which Active Directory group members are in one group and not in another? And… I want those missing (delta-ed) members put into an entirely new one.

Sure, there are many ways to do this including nested loops but the Compare-Object cmdlet makes it easy. The Compare-Object cmdlet compares two sets of objects. One set of objects is the Reference set, and the other set is the Difference set.

The result of the comparison indicates whether a property value appeared only in the object from the Reference set (indicated by the <= symbol), only in the object from the Difference set (indicated by the => symbol) or, if the IncludeEqual parameter is specified, in both objects (indicated by the == symbol).

Code Snippet

param
(
    $ReferenceGroupDN = "cn=ReferenceGroup,ou=MyTestOU,dc=contoso,dc=com",
    $DifferenceGroupDN = "cn=DifferenceGroup,ou=MyTestOU,dc=contoso,dc=com",
    $TargetGroupDN = "cn=TargetGroup,ou=MyTestOU,dc=contoso,dc=com"
)

# Import the AD module
Import-Module -Name ActiveDirectory

# Declare Variables
$ReferenceUsers = Get-ADGroupMember -Identity $ReferenceGroupDN
$DifferenceUsers = Get-ADGroupMember -Identity $DifferenceGroupDN

# See what distinguished names are present in DifferenceUsers but not in ReferenceUsers
$userDifferenceArray = Compare-Object -ReferenceObject $ReferenceUsers `
    -DifferenceObject $DifferenceUsers -Property DistinguishedName -IncludeEqual -PassThru | `
        Where-Object { $_.SideIndicator -eq "=>" }

# Add to the Target Group - $TargetGroupDN
Add-ADGroupMember -Identity $TargetGroupDN -Members $userDifferenceArray

Explanation

In my test case, ReferenceGroup has the users Test2, Test4, and Test5. DifferenceGroup has the users Test1, Test2, Test3. All are within the MyTestOU OU of my virtual contoso.com domain.

ReferenceGroup Members

DifferenceGroup Members

We are here to show Compare-Object so lets use it to compare the two AD objects based on the DistinguishedName attribute. All we need to do is run these lines:

This block just gives us the top-level members:

# Declare Variables
$ReferenceUsers = Get-ADGroupMember -Identity $ReferenceGroupDN
$DifferenceUsers = Get-ADGroupMember -Identity $DifferenceGroupDN

# See what distinguished names are present in DifferenceUsers but not in ReferenceUsers
Compare-Object -ReferenceObject $ReferenceUsers `
-DifferenceObject $DifferenceUsers -Property DistinguishedName -IncludeEqual

Executing the above line will give us this output:

We read it by using the SideIndicator property. As the documentation states, the “==” means the DistinguishedName was present in both the ReferenceObject and DifferenceObject. The “=>” means it was present only in the DifferenceObject. The “<=” means the property was only present in the ReferenceObject.

So if all I care about are those in the DifferenceObject that are not present in the ReferenceObject then we filter on the “=>” using a Where-Object.

# Add to the Target Group - $TargetGroupDN
Add-ADGroupMember -Identity $TargetGroupDN -Members $userDifferenceArray

You might have noticed that I also used the parameter “PassThru”. It allows me to keep the original type name which was Microsoft.ActiveDirectory.Management.ADPrincipal. If I don’t use the parameter "PassThru" the typename is System.Management.Automation.PSCustomObject.

Add-ADGroupMember’s parameter “Members” supports the ADPrincipal type so all is good. It does not support a PSCustomObject type.

The end result: