Implementing Dynamic Groups in Active Directory with PowerShell

When managing access permissions to different resources in an Active Directory domain, an administrator may need to create dynamic security user groups. The idea of a dynamic group is that its membership is automatically formed based on the user’s properties. For example, a group with all users from a specific location (city, OU); users from a certain department or with a specific job title, etc. Users should be automatically added to or removed from such a dynamic membership group based on the current values of their attributes.

In this article, we will look at how to implement dynamic groups in AD using a PowerShell script. Such a PowerShell script should run on a schedule, select users from AD based on a certain criterion, add them to a target AD group, and remove users from the group that no longer meet the criteria.

The following PowerShell script automatically adds all users from the specified OUs that have Sales specified in the (Department) field in AD to the target security group.

# Your AD domain name
$ADDomain = 'dc=woshub,dc=com'
# Dynamic group name
$ADGroupname = 'EastSales'
# OU list to search users
$ADOUs = @(
"OU=Users,OU=NewYork,$ADDomain",
"OU=Users,OU=Chicago,$ADDomain"
)
# Department name
$DepartName="Sales"
$users = @()
# Search for users from the target department in the specified OUs
foreach($OU in $ADOUs){
$users += Get-ADUser -SearchBase $OU -Filter {Department -like $DepartName}
}
# Add users to the target security group
foreach($user in $users){
Add-ADGroupMember -Identity $ADGroupname $user.samaccountname -ErrorAction SilentlyContinue
}
# Check that all group members meet the criteria.
# If not (user has been moved to another OU, the Department field has been changed), they must be removed from the group.
$members = Get-ADGroupMember -Identity $ADGroupname
foreach($member in $members) {
$UserOU=($member.distinguishedname -split ',', 2)[1]
if ($ADOUs -notcontains $UserOU){Remove-ADGroupMember -Identity $ADGroupname -Member $member.samaccountname -Confirm:$false}
if ((Get-ADUser -identity $member -properties Department|Select-Object Department).department -notlike $DepartName ){Remove-ADGroupMember -Identity $ADGroupname -Member $member.samaccountname -Confirm:$false}
}


Run the script and make sure that all users from the specified OUs with ‘Sales’ in the Department field have been automatically added to the EastSales group. Any user who doesn’t match these criteria will be removed from the group.

Create a scheduled task that runs the specified PowerShell script on the domain controller to update the dynamic group membership regularly (for example, twice a day).

Specify the task parameters:

Program/script: powershell.exe
Add arguments (optional): -ExecutionPolicy Bypass -NonInteractive -WindowStyle Hidden -File "C:\PS\update_dynamic_group_eastsales.ps1"

This PowerShell script can be used as the basis for creating your own dynamic security group rules in AD.