I am creating role based access for users / admins on member servers. Below listed AD groups will be present in the active directory.
- A Domain Security Group (List of Users) - Role1_UserGroup, Role2_UserGroup, Role3_UserGroup...... Role500_UserGroup
- A Domain Security Group (List of Servers) - Role1_hostgroup, Role2_hostgroup, Role3_hostgroup...... Role 500_hostgroup
I need to use group policy to add these Domain Users group (Role#_UserGroup) to the member servers listed under Role#_hostgroup. This needs to be completed using via group policy and GPO needs to be created programmatically (Power Shell).
So,
Input of the script will be Role name - Role1
The script should create a GPO named "Role1" to add users from "Role1_UserGroup" to the "Remote Desktop Users" group on all member servers listed in the "Roe1_HostGroup".
Also, create a local group "Role1_LocalUsers" and add "Role1_UserGroup" domain group to the local group.
I have achieved this using power shell script (see below script. Thanks to everyone for posting scripts. I copied part of the script from the forum). Now, I need to do same thing using GPO and create GPO programmatically.
I am unable to find any options of creating GPO programmatically. Appreciate if anyone could help me.
Here is my script. This is not a very professional looking script but it works ![]()
-------------------------------------------
$Group = Read-Host "Write the name of the group to be created"
#Initaliaze the Domain Group Object
$DomainGroup = [ADSI]"WinNT://Lab.local/${Group}_Usergroup,group"
#Get-ADGroupMember ${Group}_hostgroup | Select-Object Name | Out-File C:\temp\Scripts\${Group}_hostgroup.txt
Get-ADGroupMember ${group}_hostgroup | Select-Object Name -ExpandProperty Name | Out-File c:\Temp\${Group}_hostgroup.txt
#Read from text file
$computers= Get-Content C:\temp\${group}_hostgroup.txt
#Name the LogFile and Initialize it
$LogFile = "c:\Logs\${Group}_log.txt"
New-Item $LogFile -type file -force
ForEach ($computer in $computers) #Loop through each server
{
$computer
$computer>>$LogFile
$objOu = [ADSI]"WinNT://$computer"
$objUser = $objOU.Create("Group", "${group}_HostGroup")
$objUser.SetInfo()
$objUser.description = "${group} Group"
$objUser.SetInfo()
Start-Sleep -s 5
#Get Local Group object
$LocalGroup = [ADSI]"WinNT://$Computer/${group}_HostGroup,group"
#Assign DomainGroup to LocalGroup
$LocalGroup.Add($DomainGroup.Path)
#Determine if command was successful
If (!$?) #Add failed
{
$Server + " fail: " + $Error[0]>>$LogFile
"">>$LogFile
}
Else #Add succeeded
{
$Server + " success">>$LogFile
"">>$LogFile
$Server + " success"
}
}
--------------------------