And the following lessons will talk about working with Active Directory groups and memberships in the
previous lessons you have learnt about managing user and computer objects using power shell.
Now let's discuss how to manage Active Directory groups and their memberships.
We'll see how to perform the following operations inactive Active Directory.
Use them power shall come on lads how to create local global and universal security groups searching
and modifying group object information.
Add in group members use and computer accounts to the security groups and how to list members of a security
group in Active Directory.
Remove any user or computer accounts from groups remove and a group from groups and how to delete and
remove the ADA groups to start with.
Let's recall some basic concepts about Active Directory groups and their memberships.
What is group a group is a collection of different Active Directory objects such as user accounts computer
accounts and groups of course Active Directory groups are basically categorized into two types.
Security groups and distribution lists or groups abbreviation for routers deal respectfully.
A security group can be used to grant permissions to various resources in a network such as granting
permissions to shares NTFS permissions on new technology filesystem permissions printer permissions
and many more similar activities distribution lists are email enabled groups using which information
can be shared via email to group of people.
Simultaneously security groups can be mail enabled and used as distribution lists and vice versa.
Both of these groups are further characterized by a scope that identifies the extent to which the group
is applied in a domain tree or forest.
This means that the scope of a group determines whether it can have members from the same domain different
domains or different forests.
There are three types of scope available in Active Directory that apply to both of these groups.
They are universal global and domain local groups.
Sorry scopes.
Please consider that because distribution groups are used for email and most importantly for Microsoft
to exchange applications.
We won't discuss it so much.
We will limit our discussion to security groups in this lessons.
And as you may know in a Windows environment Active Directory security groups play an important role
using groups to delegates grant permissions is very scalable compared to granting permissions to an
individual user or computer account.
That's why it is very important for Windows system administrator to understand how to automate it to
its maximum extent the usage of the group's security groups in Windows environment.
So let's start with creating different types of security groups.
As I have mentioned there are different types of security groups available in Active Directory such
as global domain local and universal to create a new group an Active Directory.
They're new there's a group command led can be used this command let accepts three parameters.
These are the name of the group.
The organizational unit path in Ada and groups code such as domain local global or universal name and
group scope need to be provided mandatorily.
So let's review some simple command line examples to create a new blank a group in a DB is no members
in it.
The following command creates a new active directory group of type domain local and specified Oh you
will do that with new dash Ada Group Command glad we can give it a name.
We must give it a name.
We have to specify a path to this group.
In my case it will be in production or you in groups or you and groups globe parameters should be specified
in my case it's domain local.
Similar relate to create other group types.
Change the parameter group's scope the following simple command creates a global group and a universal
group.
The code is the same as in the previous example but we can change the group scope to global and group
scope universal.
Now some words about searching and modifying group object information search in active directory for
the presence of a group is similar to search and user assigned groups.
A command loud call to get there is a group from the active directory module can be used to get grouped
object information.
For example we can use the following command to get display name of all groups in active directory.
Get a group filter asterisks with me which means all the groups and by a bit to select by the name.
As I have mentioned by specify an asterisk is an argument to do the filter parameter they are wherein
all groups in active directory and then display the value of the name property use in the SELECT statement
to search for a specific group by name.
We can pass the name of the group to the filter parameter as in this example get the group filter name
is equal to task group one for example on some other name of the group.
These command searches active director for groups which name exactly matches test group one or project
one group or whatever name you are looking for and returns the group object if present.
Otherwise no output assume there is some other parameter that helps in performing the search operation
an active directory.
That is the dash l derp filter parameter the filter parameter and the older filter parameter perform
the same type of search operation but the syntax is in which you pass the values is different the filter
parameter takes the power shell type of syntax and that filter takes the old DEP type of syntax.
The example which we have which we had before was written using the filter parameter which uses the
power shell syntax the same command can be rewritten to use an old DAB filter Adams's command get a
group elder filter parameter and the query looks like that name equals test group one based on your
comfort level you can use either filter or hold up filter or parameter to perform searches.
This is applicable for other common LEDs such as they get a the user and get a computer parameters enough.
Another difference to note here is that filter can take the property names returned by command LEDs
in the active directory model.
But but Il derp filter parameter requires the exact attribute names in general using the filter parameter
to perform search operations is sufficient.
The elder filter parameter can be used to test the existing older filters or the filters used in other
programming languages that query active directory use an elder.
Now that we all know how to search for a single group an active directory let's see how we can perform
a search for multiple groups using the get a the group command led groups that match a particular naming
convention can be where it used in the following command.
Gather the group filter parameter and we are looking for name.
Beaches like test so it should contain this word test in its name.
This command will return all group objects that have the test and their name property.
The filter parameter can be further customized to be used to various search and needs.
For example we can extend our previous code to search for groups that contain the string domain in their
name attribute.
Like in this command get a group filter.
Name should contain test string in it or name should contain demands through internet.
Similarly if you have a list of groups in a text file and you want to know whether they are present
an active directory you can use the following code.
This is a simple code that treats the group names from a text file located in the directories specified
loops through each group name in the text file and checks whether it is present in active directory
or not.
Once you have the object information in the group you are looking for.
It is easy to modify the group object information using the set a do group command led group to object
information is a display name of the group description group type and so on modifying the membership
of groups doesn't fall within the scope of this lesson.
In the next lesson we'll talk in detail about membership modification.
The following commands will help in adding a description to the group objects they get a group command
Gladwell query active directory based on the provided filters and the results are passed to the sad
age group command led so that it can set the description to a defined stream.
So let's review this.
Come this code we are getting group with the name which is equal to test group and set a new description
to this group will set a group command led and description parameter and the description itself which
should be in quotes.
If you want to update the description for all groups that have tasks in their name then you could use
the following command guide to the group filter test 3 and end it pipe it to Saturday group with the
description with the new description parameter which should be specified in quotes again.
Similarly groups scope can be changed you then that set a group command led as shown in the following
command.
Get a group filter name is equal to task group and set a group.
Group scope and new group scope which you want to specify.
For example domain local to see the current scope and the group category of the group.
You can use the following command get age group identity test group and select Name group category and
groups go and you can find this information in the output of this command.
Also the group type security or distribution can be changed by passing the required type to the group
category parameter for the certain group command led.
And here is an example for this girl to the group filter a name should look like.
Test test training it and set the group with new group category.
For example distribution groups can be configured as email enabled security groups which helps them
both.
Sending emails and granting security permissions since email enabled security groups require Microsoft
Exchange installation.
We won't cover it here but Microsoft Exchange power shall snap.
Ian has a command lad that can configure security group as a mail enabled security group.