Groups

Description

Groups are the binding glue that allows effective permission delegation and message distribution service to actually work. This Component allows you to define your own groups but does not cover group membership assignments.

See the Group Membership Component for managing group memberships.

Example Configuration

A sample group defined:

[
    {
        "Path":  "OU=Groups,OU=Administration,%DomainDN%",
        "Name":  "Tier 1 Accounts",
        "Description":  "All Accounts operating at Tier 1",
        "Scope":  "Global"
    }
]

This creates the “Tier 1 Accounts” global group under the specified OU.

Tools

Convert all groups to configuration:

Get-ADGroup -Filter * -Property Description | Select-PSFObject @{
  Name = 'Path'
  Expression = { $_.DistinguishedName -replace ',DC=.+$',',%DomainDN%' -replace '^.+?,' }
}, Name, "Description to string", 'GroupScope as Scope to String' | convertTo-Json

Properties

Name

This parameter uses name resolution.

The name of the group.

SamAccountName

This parameter uses name resolution.

The SamAccountName of the group. Defaults to the Name if not otherwise specified.

Path

This parameter uses name resolution.

Path (distinguishedName) of the OU to place the group in.

Description

This parameter uses name resolution.

Description of the group.

Scope

The scope of the group. Use DomainLocal for groups that grrant direct permissions and Global for role groups.

Category

Default: Security

Optional: yes

Whether the group should be a security group or a distribution group.

OldNames

Previous names the group used to have. By specifying this name, groups will be renamed if still using an old name. Conflicts may require resolving.

Present

Default: $true

Optional: yes

Whether the group should exist. Set to $false for explicitly deleting groups, rather than creating them.

Optional

Group is tolerated if it exists, but will not be created if not.