Help creating a script to move users in and out of an OU based on a time limit

here's scenario: have ous based on locations of our facilities, have sub-ou(?) underneath users need group policy applied them whitelist applications allowed run. time time have need pull users out of sub-ou short period of time let them run applications wouldn't able , won't need run long term. forget add these people policy controlled sub-ou because busy other things. server 2008 r2.

here's i'm looking for: script prompts users name, pulls user out of sub-ou, puts them in main ou 24 hours. after time limit up, script/command runs puts user in policy controlled sub-ou. i'm thinking ps script best way this.

research: looking @ these posts here and here i'm thinking should able frankenstein have limited ps scripting experience.

can me create this?

you've figured out, we're not typically in business of writing complete solutions people. said, there projects find particularly interesting, such one, willing started if willing take time work through examples , learn them.

you have 2 requests - 1 script prompts user moves different  location in active directory. second request way move them without manual interaction. require automated task (scheduled task) run @ select times during day.

here's first script (1/2): first 2 lines set 2 different variables. first line sets $oupath variable subou. second line prompts user and, once user entered, sets user $user variable. runs first try-catch, attempting replace $user variable data returned get-aduser cmdlet. notice use of -properties parameter. default modified date , extensionattributes not returned. using modified date can 24 hours passes before move them (see part 2/2). including extensionattribute13 ensure move users out of ou if moved in script. note: modified date on user in ad changed when moved 1 ou another. if user cannot located in first try-catch cannot locate user in active directory. if can locate it, set $user variable, described far, , move on.

in second (or, nested) try-catch split user's distingusihedname @ first comma have 2 parts. use second part (that doesn't include cn) , see if matches $oupath variable. if match user has been moved. if doesn't match 1. move user, 2. replace extensionattribute13 string 'moveduser,' , 3. output user has been moved.

$oupath = 'ou=subou,ou=mainou,dc=mydomain,dc=com' $user = read-host -prompt 'enter samaccountname'  try {     $user = get-aduser -identity $user -properties modified,extensionattribute13      try {         if ($user.distinguishedname.split(',',2) -eq $oupath) {             write-output -verbose 'user moved.'         } else {             move-adobject -identity $user.distinguishedname -targetpath $oupath                  set-aduser -identity $user.samaccountname -replace @{extensionattribute13='moveduser'}             write-output "'$($user.samaccountname)' has been moved."         }     }     catch {         write-output "'$($user.samaccountname)' cannot moved."     } } catch {     write-output -verbose "unable locate '$user' in active directory." }

the second script (2/2): here set couple variables - 1 subou's distinguishedname want return user , other of users mainou. foreach user in $users check if extensionattribute13 set 'moveduser' , if modified date greater or equal (-ge) 24 hours. if is, script move user, clear extensionattribute13, , let know user moved. if reason $oupath variable wrong, script run catch portion of try-catch used in script. again, you'll have schedule task scheduler run script. luck!

$oupath = 'ou=mainou,dc=mydomain,dc=com' $users = get-aduser -filter * -searchbase $oupath -properties modified,extensionattribute13  foreach ($user in $users) {     $timesince = new-timespan -start $user.modified -end (get-date)     if ($user.extensionattribute13 -eq 'moveduser' -and $timesince.hours -ge 24) {         try {             move-adobject -identity $user.distinguishedname -targetpath $oupath             set-aduser -identity $user.samaccountname -clear extensionattribute13             write-output "$($user.samaccountname) has been moved."         }         catch {             write-output "$($user.samaccountname) cannot moved."         }     } else {         write-output 'no users move.'     } }

if decide use this, sure change paths use $oupath variables. also, if you're using powershell 2.0, need use import-module cmdlet import activedirectory module. in versions above 2.0 imported automatically if try use ad cmdlet.

edit: typo - get-aduser property

Windows Server  >  Windows PowerShell