One way would be to keep a list of groups that have previously been traversed and only recurse if the group you come to hasn’t been done yet. One of the tricks with recursion is that each time you execute the function a new “scope” is created. So variables you set (unless it is a global variable) are only valid in the context of that specific function execution.
SO… you either need to keep track with a global variable, or define a new parameter for the function that allows you to pass the current count of nesting in.

Are you running into an issue with circular nesting using the script?
== Mark

Felix,
This script should walk your nested groups and pull out the list of users from all of those sub-groups.
I did a search through my post and I realize that the “special” characters got HTML-ized when I posted.

The “&” should just be an ampersand character….and the “>” is a GreaterThan symbol.
I have corrected it, so I would recopy the script…

I think this is why you may have been getting errors with “.Split”.

The “.Split” that I am doing is a Method of the [String] type. This is part of Poweshell V1.0. On what line are getting this error?

Hope this helps and thanks for pointing out the errors…
— Mark

PSNOOB,
I will try to assist if I can.
First off, I notice the line it is erroring on:

ForEach ($user in $Users) {Where-Object -FilterScript ($_.Memberof -ne ‘Allpartners’)} {

The error that PoSh is generating is actually due to using parentheses for the Where-Object cmdlet. These should be curly braces…
ForEach ($user in $Users) {Where-Object -FilterScript {$_.Memberof -ne ‘Allpartners’}}

That being said, it will most likely error out again because you are using the “default variable” $_ to try to reference the individual user object. “$_” is used when piping cmdlets together to reference the object being piped in.
An example of this would be:
get-childitem “C:\Temp” | Where-object {$_.Name -eq ‘foo.txt}

I believe that Where-Object requires it to be on the right-side of a pipe (“|”).
Since you are already in the ForEach loop, you should just be using the $user variable and testing to see if it is a member of your group.

The “MemberOf” property of a user account is actually an array of items. Because of that you should probably use “-NotContains” in your condition. “Contains” and “NotContains” look through the entire array and tests each entry against your condition. The groups that are put here are referenced by their distinguished name.

When you assign your $users variable, you seem to be pulling in only users that are already members of the “AllPartners” group. Is that correct?
If so, then you will only have users that are ALREADY in that group, not all users in that OU. I have pulled that out of my revision below.

All-in-all very good, especially if you are new to this. I hadn’t seen the assignment of a primary group before, so that may come in useful for me.

Below I have made some modifications to your script that I think will do what you need. I am not in a place that I can test the code right now, so please take a look and let me know how it goes.

I hope my explanations help…but if not, please let me know and I can elaborate more.

Anyway.. Thanks for stopping by and Keep PoSh-ing!!!

– Mark
#——Begin Code ——————–#

#Get all users in the OU below
$users = Get-QADUser -SearchRoot ‘OU=Enabled,OU=Users,OU=Partners,DC=xxx,DC=com’

#Read in the user’s credentials and store password as secure string
$un = read-Host “User Name domain\username” # Your domain and username
$pw = read-host “Enter password” -AsSecureString # Your Password

#Define the group to make my primary group
$group=“CN=AllPartners,OU=Groups,OU=Partners,DC=xxx,DC=com”

#Connect to the domain with supplied credentials
connect-QADService -service ‘xxx.com’ -ConnectionAccount $un -ConnectionPassword $pw

#Look at each user and see if they are already in the group
ForEach ($user in $Users) {
#If they are not already a member, then we need to add them to the group
if ($user.Memberof -NotContains $group)
{
add-QADGroupMember -identity $group -member $user
}
#Set the primary group for the user
Set-QADUser -Identity $user -ObjectAttributes @{primaryGroupID=@(222753)

#Remove the user from “Domain Users” group
Remove-QADGroupMember -Identity ‘Domain Users’ -Member $user
}

@PSNOOB
I will run this against my lab system and see, but I think it may just be a syntax issue with the quotes/apostrophes used.
Try modifying it to be this ( with ” instead of ’ ) :

Remove-QADGroupMember -Identity “Domain Users” -Member $user

I will test and post later tonight.

– Mark

Okay.. it is amazing how one little bracket/brace/parenthesis can wreak such havoc.

The error in the last run you did was from not closing the curly brace at the end.
Set-QADUser -Identity $user -ObjectAttributes @{primaryGroupID=@(222753)}

I have also done some other things in the code below. The Quest tools tend to spit out lots of data when setting objects or connecting to services, etc.
If you want to see those outputs, remove the ” > $null” pieces from those lines. Basically this says to redirect the console output to $null (or nothing). This essentially suppresses the output from those cmdlets.
I then have a few “write-host” lines to echo what is going on.

BTW: Another way to get credentials is with the Get-Credential cmdlet. You could replace these lines:
$un = read-Host “User Name domain\username” # Your domain and username
$pw = read-host “Enter password” -AsSecureString # Your Password
.
.
connect-QADService -service “xxx.com” -ConnectionAccount $un -ConnectionPassword $pw > $null

with just this one:
connect-QADService -service “xxx.com” -Credential (Get-Credential) > $null

Let me know how it goes!
— Mark

#—-Begin Code ————————————#
#Get all users in the OU below
$users = Get-QADUser -SearchRoot “OU=Enabled,OU=Users,OU=Partners,DC=xxx,DC=com”

#Read in the user’s credentials and store password as secure string
$un = read-Host “User Name domain\username” # Your domain and username
$pw = read-host “Enter password” -AsSecureString # Your Password

#Define the group to make my primary group
$group=”CN=AllPartners,OU=Groups,OU=Partners,DC=xxx,DC=com”

#Connect to the domain with supplied credentials
connect-QADService -service “xxx.com” -ConnectionAccount $un -ConnectionPassword $pw > $null

#Look at each user and see if they are already in the group
ForEach ($user in $Users) {
#If they are not already a member, then we need to add them to the group
if ($user.Memberof -NotContains $group)
{
Write-Host Adding $User.samaccountname to $group …
add-QADGroupMember -identity $group -member $user > $null

}
#Set the primary group for the user
Write-host Setting primaryGroup…
Set-QADUser -Identity $user -ObjectAttributes @{primaryGroupID=@(222753)} > $null

#Remove the user from “Domain Users” group
Write-host Removing $user.samaccountname from Domain Users group…
Remove-QADGroupMember -Identity “Domain USers” -Member $user > $null
}

#—-END Code———————————–#

Thanks very much. I hope to be posting more AD-related stuff soon, so stay tuned!
— Mark

Thanks for the correction. I will update this to force typing on this parameter.
– Mark