Nsryjdtyk

The following code takes all users from a selected OU. It scans their group membership and if these groups are not under their own OU it creates new groups, adds all members to this group, adds the new group to the old group and removes all members from the old group. This is part of a clean-up.

My concern is to ensure if the group is not created but the users are removed from their old group already, it would cause quite a bit of trouble.

Therefore, I entered the try{}-catch{} blocks and finally also the log file. I am wondering however whether there is a better and safer way to ensure the operation to be running and logging errors properly.

$list = Get-ADUser -Filter * -SearchBase "OU=PrivilegedAccounts,DC=Global,DC=Local"

$IAM = '*OU=PrivilegedAccounts*'

$DA = '*Domain Users*'

$ErrorActionPreference = "Stop"

$Error.Clear()



#Goes through the user list one-by-one

foreach ($user in $list)

    {

#$GroupMembership takes the group membership for each user from the list

    $GroupMembership = $user | Get-ADPrincipalGroupMembership



    foreach ($Group in $GroupMembership)

            {

#Takes every group and checks whether the groups does not contain neither 'PrivilegedAccounts' nor 'Domain Users'

            if (($Group.distinguishedName -notlike 

                 $IAM) -and ($Group.distinguishedName -notlike $DA))

                {

#$NewGroup sets the name for the new 'prefix-'group name

                $NewGroup = $("prefix-" + $Group.name)



#Creates a new AD group in the PREFIX OU structure

                New-ADGroup -Name $NewGroup -Path "OU=PrivilegedAccounts,DC=Global,DC=Local" 

                                                   -GroupScope Global



<#

Adds the new PREFIX group to the old group

Adds the prefix-account to the new PREFIX group

Checks whether any of the functions throw an error. If yes, the script will be exited                

#>

                try{

                    Add-ADGroupMember -Identity $Group.name -Members $NewGroup

                    Add-ADGroupMember -Identity $NewGroup -Members $user.Name

                    Remove-ADGroupMember -Identity $Group.name -Members $user.Name -Confirm:$false

                    }

                   Catch

                        {

                        $_.Exception.Message

                        }



                $Error | Out-File -FilePath C:UsersPublicDesktopAD_errors.txt

                }

            }

    }