The following lessons we'll talk about working with Active Directory groups and memberships in the previous
lessons you've learnt about managing user and computer objects use and power shell.
Now let's discuss how to manage Active Directory groups and their memberships.
We'll see how to perform the following operations in Active Directory.
Use them power.
Shell come and lets.
How to create local global and universal security groups searching and modifying group object information
add in group members use their own computer accounts to the security groups and how to list members
of a security group in Active Directory or remove any user or computer records from groups.
Remove a group from groups and call to delete and remove that eighty groups to start with.
Let's recall some basic concepts about Active Directory groups and their memberships.
What is group a group is a collection of different Active Directory objects such as user accounts computer
accounts and groups of cons Active Directory groups are basically categorized into two types.
Security Groups and distribution lists or groups abbreviation for it is DL.
Respectfully a security group can be used to grant permissions to various resources in a network such
as Grant and permissions to share as NTFS permissions on new technology.
File system permissions printer permissions and many more similar activities.
Distribution lists are email enabled groups on which information can be shared.
Why the email to a group of people simultaneously security groups can be mail enabled and Ustaz distribution
lists and vice versa.
Both of these groups are further characterized by a scope that identifies the extent to which the group
is applied.
In a demand tree of forest.
This means that the scope of a group determines whether it can have members from the same domain different
domains or different forests.
There are three types of scope available in active directory that apply to both of these groups.
There are universal global and Domain Local groups.
So is scope's.
Please consider that because distribution groups are used for email and most importantly for Microsoft
Exchange applications.
They won't discuss it so much.
We will limit our discussion to security groups in these lessons and as you may know in a Windows environment
Active Directory security groups play an important role in groups to delegate.
Grant permissions is rescale a build compared to granting permissions to an individual user or computer
account.
That's why it is very important for Windows system administrator to understand how to automate it to
its maximum extent the usage of the group's security groups in a Windows environment.
So let's start with create and different types of security groups.
As I've mentioned there are different types of security groups available in Active Directory such as
Global Domain Local and universal.
To create a new group in Active Directory their new nudist aided group command led can be used.
This command left accepts three parameters.
These are a name of the group.
The organizational unit bath in HD and group scope such as Domain Local global or universal name sound
group scope need to be provided mandatorily.
So let's review some simple command line examples to create a new blank Adey group in a D with no members
in it.
The foreign command creates a new Active Directory a group of type Domain Local and they specify it.
Oh you will do that with new Desch the group.
On glad we can give it a name.
We must give it a name.
We have to specify pass to this group.
In my case it will be in production are you in groups o you and groups.
Job parameters should be specified.
In my case it's Domain Local.
Similarly to grade other group types change the parameter groups go for and sample command creates a
global group and a universal group.
The goal is the same as in the previous example but we can change the group's code to global and group
scope universal.
Now some words about searching and modifying group object information search an active directory for
the presence of a group is similar to search on users and groups I come on loud call to get a group
from that active directory module can be used to get grouped object information.
For example we can use the following command to get display name of all groups in Active Directory get
a group filter asterisks read me which means all the groups and pipe it to a select by the name.
As I've mentioned by specify an asterisk is an argument to the filter parameter wherein all groups in
Active Directory and then display the value of the name property.
You can then select statement to search for a specific group by name.
We can parse the name of the group to the filter parameter.
In this example getting the group filter name is equal to test group one for example or some other name
of the group.
These commands searches Active Directory for groups which name exactly matches test group one or project
one group or whatever name you are looking for and three tones of a group object if present otherwise
no output is.
There is some other parameter that helps in performing their search operation in Active Directory that
is there.
There's a whole depth filter parameter the filter parameter and the old filter parameter perform the
same type of search operation but the syntax is in ratio pass lvalues is different.
The filter parameter takes the power shell type of syntax and old that filter takes the old Derbe type
of syntax.
The example which we have which we had before was written Yodels a filter parameter which uses the power
shell syntax the same command can be rewritten to use an elder filter Adams's command get a group elder
filter parameter and the Cuero looks like that name equals tells group 1 based on your comfort level
you can use either the filter or Derb filter parameter to perform searches.
This is applicable for Arzak command lets such as like get a user and get a the computer parameters.
And another difference to note here is that filtering can take the property names returned by command
laths in the Active Directory Mod. bar.
But Ill dirt filter parameter requires the exact attribute names in general use of the filter parameter
to pick from search operations is sufficient.
Elder filter parameter can be used to test the existing older filters or the filters used in other programming
languages that Querrey active directory use an elder app.
Now that we all know how to search for a single group an active directory.
Let's see how we can perform a search for multiple groups.
You then get a D group come and let groups that match a particular name and convention can pick where
it used and the following command go to the group filter parameter and look in full name which is like
a test.
So it should contain this word test in its name.
This command will return all group objects that have their story and text in the Name property.
The filter parameter can be further customized to be used to various search needs.
For example we can extend our previous code to search for groups that contain this tree and domain in
the name attribute.
All I can do is come and get a group filter name should contain a text string in it.
Or name should contain mainstream.
And similarly if you have a list of groups in a text file and you want to know whether they are present
in Active Directory you can use the following code.
This is a simple code that treats the group names from a text file located in the directory specified
or loops through each group name in the text file and checks whether it is present in Active Directory
or not.
Once you have the object information in the group you're looking for it is easy to modify the group
object information to you then the set a group come and let grouped object information is a display
name of the group description group type and so on modifying their membership of groups doesn't fall
within the scope of this lesson and the next lesson will talk in detail about membership modification
in command will help imagine a description to the group objects that get a group command that will Querrey
Active Directory based on the provided filters and the results are passed to the SAT group command level
so that it can set the description to a defined stream.
So let's review this come this code.
We are Gatun group with the name which is equal to test group and set a new description to this group
we set a group command left and description parameter and the description itself which should be in
quotes if you want to update the description for all groups that have text in their name.
Then you could use the following command.
Get the group filter test string in and pipe it to a certain age group with the description within your
description parameter which should be specified in quotes again.
Similarly group scope can be changed.
You then said Take the group command left as shown in the following command.
Get a group filter name is equal to test group and set a group.
Scope and new group scope which you want to specify for example Domain Local to see the current scope
and the group get together of the group.
You can use the following command that do group identity test group and select name group category and
groups go and you can find to this information in the output of this command.
Also the group type security or distribution can be changed by boss and the required type to the group
category parameter for a certain group command left.
And here is an example for this.
Get a group filter name should look like.
Test test Trewin in it and say that the group was new group category.
For example distribution groups can be configured as email enabled security groups which helps them
both sending emails and granting security permissions since email enabled security groups require Microsoft
Exchange installation.
We won't cover it here but Microsoft Exchange Parshall's snap even has a command line that can configure
security group as a mail enabled security group.