Programatically Set Primary Group

Question

_{Monday, August 22, 2011 2:40 AM | 1 vote}

I am trying to find a way to set the primary group of 100 user accounts.  They need to be removed from Domain Users, but I cannot do this without designating a different primary group, thus the need for this.  Ideally this would be set at account creation, and it looks like with the -otherattributes parameter this would be possible, but it's a catch 22 because users can't belong to a group until they're created, and I don't see anything in new-aduser to add a user to a group. 

This doesn't necessarily have to be done in PS, and doesn't have to be done at account creation.  It seems that there must be way to do this, and I would be thankful for any ideas.  The final goal is for these accounts to be unable to access any resources where Domain Users are explicitly granted access.  I cannot think of an alternate way to do this other than by using Deny in the ACLs, which isn't an option.

Thanks.

All replies (6)

_{Monday, August 22, 2011 12:49 PM ✅Answered | 7 votes}

Hi,

Sounded interesting so I had a look.

$group = get-adgroup "YourGroup"
$groupSid = $group.sid
$groupSid
[int]$GroupID = $groupSid.Value.Substring($groupSid.Value.LastIndexOf("-")+1)

If you replace "YourGroup" with a group you want to test with you should get the correct group id.

Get-ADUser "YourTestUser" | Set-ADObject -Replace @{primaryGroupID="$GroupID"}

Now replace "YouTestUser" with the account your testing with. I assume the acount is already a member of the group. once you've change the primary group you can remove them from the Domain Users group.

Does that help?

J

---

_{Monday, August 22, 2011 7:44 PM | 1 vote}

Thanks, much appreciated.  I was concentrating on set-aduser, so I could have been stuck on that forever. 

I was able to determine from looking at ADSI what the group ID is, and that the LDAP attribute is "primaryGroupID".  I basically just need to run Get-ADUser against my list and pipe it to "Set-ADObject -Replace". 

Have a digital beer on me!

---

_{Tuesday, February 16, 2016 12:07 AM | 7 votes}

Just stumbled across this post trying to do exactly the same thing, based on your answer and some other search results I came up with the following which makes your method a little simpler:

$group = get-adgroup "YourGroup" -properties @("primaryGroupToken")
get-aduser "YoutTestUser" | set-aduser -replace @{primaryGroupID=$group.primaryGroupToken}

---

_{Tuesday, June 7, 2016 12:42 PM}

This did the trick for me.  Short and clean.  Thank you for sharing.

---

_{Tuesday, February 14, 2017 10:50 AM}

Hey.. when I try this, I have to confirm set-aduser all the Time,

but I want to do this in Scripts and for mass Import...

does anyone now, how to handle this...?

---

_{Wednesday, February 15, 2017 3:10 AM}

Are you sure you didn't add the -confirm parameter? Otherwise it shouldn't prompt for confirmation.

(I edited this post after I realized I had given bad information regarding that switch. Sorry for that mistake.)