Synchronizing AD Group Members to Unix Attributes

Table of Contents

Auditors are sticklers (as they’re meant to be). They, like many of us in the IT world, want clean data. So what happens when you grant a user unix access via AD but don’t clean it up?

What #

A disabled AD account with unix access cannot login, but would still show up in our reports. This made for a lot of questions from auditors which equals sad sysadmins.

How #

I decided to solve this using by using our AD groups. As part of our term process we remove the termed employee from any group they were a part of (distribution and security). So, for us, the source of truth was AD.

Prerequisites #

Powershell
Quest Powershell Modules
Scheduling mechanism (Task, etc.)

Complete Code #

$groups = Get-QADGroup -SearchRoot "company.com/UnixGroups"
foreach ($group in $groups) {
  # Get Members
  $members =  Get-QADGroupMember $group -Type 'user' -Indirect
  # Check if no members
  if($members.Count -gt 0) {
    # Blank arrays
    [array]$dn = @()
    [array]$sam = @()
    # Loop through each
    foreach ($member in $members) {
      $user = Get-QADUser $member -IncludedProperties uidNumber
      # Add unix attributes if missing.
      if (!$user.uidNumber) {
          $ypDomain = Get-QADObject -Identity "cn=company,cn=ypservers,cn=ypserv30,cn=RpcServices,cn=system,dc=company,dc=com" -IncludedProperties msSFU30MaxUidNumber
          $uid = $ypDomain.msSFU30MaxUidNumber
          $maxUidNumber = $uid + 1
          Set-QADUser -Identity $user -ObjectAttributes @{
              msSFU30NisDomain='company';
              uidNumber=$uid;
              loginShell='/bin/bash';
              unixHomeDirectory="/home/$Identity";
              gidNumber='100';
            }
          # Update upDomain
          $ypDomain | Set-QADObject -objectAttributes @{msSFU30MaxUidNumber = $maxUidNumber}
      }
      # Add to array of users
      $sam += $user.SamAccountName
      $dn += $user.DN
    }
    # Add to group unix attributes
    Set-QADGroup $group -ObjectAttributes @{msSFU30PosixMember=$DN;memberUid=$sam}
  }
}

At some point I’ll rewrite this to not use the Quest modules because less dependancies are better.