AD dynamic group on premise AD

Question

Hello
looking for a way to create a dynamic group, looking at an existing OU in AD. but exclude any account that is disabled.
if i have to created a scheduled task under windows to kick off a PowerShell script, that's fine.
not user what syntax to use to exclude disabled accounts.

Get-ADUser -Filter * -SearchBase ‘OU=Users,OU=NY,OU=USA,DC=theitbros,DC=com’|
ForEach-Object -process {Add-ADGroupMember -identity "NY Users" -Members $_.SamAccountName}

Answer 1

Hi，

The -Filter parameter can get the enabled/disabled users for you.

$enabled = Get-ADUser -Filter {enabled -eq $true} -SearchBase ‘OU=Users,OU=NY,OU=USA,DC=theitbros,DC=com’  
$disabled = Get-ADUser -Filter {enabled -eq $false} -SearchBase ‘OU=Users,OU=NY,OU=USA,DC=theitbros,DC=com’  
Remove-ADGroupMember -identity "NY Users"  -Members $disabled -Confirm:$false  
Add-ADGroupMember -identity "NY Users" -Members $enabled  

Best Regards，
Ian Xue

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

The below will get all users starting at the search base that are enabled (i.e., not disabled):

Get-ADUser -LDAPFilter "(!userAccountControl:1.2.840.113556.1.4.803:=2)" -SearchBase "OU=...."

Answer 3

To remove any disabled users from the group, try this:

# build a hash of all group member distinguishedNames  
$m = @{}  
(Get-ADGroup -Identity "NY Users").members |  
    ForEach-Object{  
        $m.$_ = ""  
    }  
# get the distinguishedName of all disabled users  
(Get-ADUser -Filter {Enabled = $false} -SearchBase "OU=Users,OU=NY,OU=USA,DC=theitbros,DC=com").distinguishedName |  
    ForEach-Object{  
        if ($m.ContainsKey($_)){    # is the disabled user a member of the group?  
            $d += $_  
        }  
    }  
Remove-ADGroupMember -Identity "NY Users" -Members $d   # remove disabled members from group  

Note: I no longer have an AD to test this with.