dynamicgroup.ps1

gistfile1.txt

#add extension attribute in adds
$currUser = Get-ADUser 'brad.stevens' -Properties * -server "demo365lab.net"
$currUser | Set-ADUser -clear msDS-cloudExtensionAttribute1
$currUser | Set-ADUser -Add  @{"msDS-cloudExtensionAttribute1"='google_mailbox'}
#$currUser | Set-ADUser -Add  @{"msDScloudExtensionAttribute1"='microsoft_mailbox'}

$domainpath = “CN=Users,DC=demo365lab,DC=net”
#create groups in adds
new-ADGroup –name "GoogleUsrMBX_M365E3_NoMBX” –groupscope Global –path $domainpath
new-ADGroup –name "M365UserMBX_M365E3_MB” –groupscope Global –path $domainpath
new-ADGroup –name "SSO-GSuite” –groupscope Global –path $domainpath
#nest groups
Add-ADGroupmember "SSO-GSuite” "GoogleUsrMBX_M365E3_NoMBX”
Add-ADGroupmember "SSO-GSuite” "M365UserMBX_M365E3_MB”
 
 
$domainpath = “CN=Users,DC=demo365lab,DC=net”
#ADDS dynamic group script - This will check the extension attribute and based on value remove or add
$members = Get-ADUser -Filter * -SearchBase $domainpath -Properties msDS-cloudExtensionAttribute1
#remove loop
foreach($member in $members)
{
if($member.'msDS-cloudExtensionAttribute1' -ne "microsoft_mailbox")
  {
    write-host 'NE M365UserMBX'
    Remove-ADGroupMember -Identity "CN=M365UserMBX_M365E3_MB,CN=Users,DC=demo365lab,DC=net" -Members $member.samaccountname
  }elseif($member.'msDS-cloudExtensionAttribute1' -ne "google_mailbox"){
    write-host 'NE GoogleUserMBX'
    Remove-ADGroupMember -Identity 'CN=GoogleUsrMBX_M365E3_NoMBX,CN=Users,DC=demo365lab,DC=net' -Members $member.samaccountname
  }else{
    write-host 'OTHER'
  }
}
#add loop
foreach($member in $members)
{
if($member.'msDS-cloudExtensionAttribute1' -eq "microsoft_mailbox")
  {
    write-host 'EQ M365UserMBX'
    Add-ADGroupMember -Identity "CN=M365UserMBX_M365E3_MB,CN=Users,DC=demo365lab,DC=net" -Members $member.samaccountname
  }elseif($member.'msDS-cloudExtensionAttribute1' -ne "google_mailbox"){
    write-host 'EQ GoogleUserMBX'
    Add-ADGroupMember -Identity 'CN=GoogleUsrMBX_M365E3_NoMBX,CN=Users,DC=demo365lab,DC=net' -Members $member.samaccountname
  }else{
    write-host 'OTHER'
  }
}