Styjun

I have problems of understanding values of variables in PowerShell and I check them with if statements.

$LDAPDirectoryService = '10.10.XXX.XXX:389'
$DomainDN = 'o=Enterprise'
#$LDAPFilter = '(&(objectCategory=Person)(memberOf=cn=alc-01-Planung-rw,ou=KT,o=enterprise))'

$LDAPFilter = '(&(cn=alc-01-Planung-rw))'

$null = [System.Reflection.Assembly]::LoadWithPartialName('System.Net')

$LDAPServer = New-Object System.DirectoryServices.Protocols.LdapConnection $LDAPDirectoryService
$LDAPServer.AuthType = [System.DirectoryServices.Protocols.AuthType]::Anonymous

$Scope = [System.DirectoryServices.Protocols.SearchScope]::Subtree
$AttributeList = @('*')

$SearchRequest = New-Object System.DirectoryServices.Protocols.SearchRequest -ArgumentList $DomainDN,$LDAPFilter,$Scope,$AttributeList

$groups = $LDAPServer.SendRequest($SearchRequest)
$groups

if ($groups -eq $null) "No Group found"
if ($groups -eq " ") "No Group found"

foreach ($group in $groups.Entries) 
 $users = $group.attributes['member'].GetValues('string') 
 foreach ($user in $users) 
 Write-Host $user
 

I want to check if the group exists and then if users are existing in this group. I tried many statements but none of them seem to work.
It's not null or blank, even when nothing is written down in the console.

This is what I got when I use group which doesn't exist:

Can anybody show me a solution?

What version of PowerShell are you running? Why are you not using the built-in AD group cmdlets for this or are you not using ADDS but some other LDAP service?

Or you may be on OSX/Linux and are using PSCore, which the ADDS/RSAT cmdlets are not there, well, not yet?

For your goals of …

I want to check if the group exists and then if users are existing in
this group.

… On Windows, with PowerShell 3x or higher, it's really only this...

# Get all AD groups and all members of each group
Clear-Host
(Get-ADGroup -Filter '*').Name | 
%
 "`n*** The members of $PSItem are as follows: ***`n"
 If((Get-ADGroupMember -Identity $PSItem).Count -ge 1)
 
 (Get-ADGroupMember -Identity $PSItem).SamAccountName
 
 Else
 
 Write-Warning -Message "$PSItem does not exist or has no members."
 



# Filtered
Clear-Host
((Get-ADGroup -Filter '*').Name -match 'Domain Admins|Domain Users' ) | 
%
 "`n*** The members of $PSItem are as follows: ***`n"
 If((Get-ADGroupMember -Identity $PSItem).Count -ge 1)
 
 (Get-ADGroupMember -Identity $PSItem).SamAccountName
 
 Else
 
 Write-Warning -Message "$PSItem does not exist or has no members."

 

Using your LDAP approach though... How about this...

'Administrators','Distributed COM Users' | 
ForEach 
 # Define LDAP search root, the Global catalog of the domain
 $sLDAPSearchRoot = "LDAP://$((Get-ADDomainController).IPv4Address):389"

 # The Groupname to looking for
 ($sGroupName = "$_")

 # The LDAP query - query string
 $sSearchStr = "(&(objectCategory=group)(name="+$sGroupName+"))"

 # Get the search object
 $oSearch = New-Object directoryservices.DirectorySearcher($oADRoot,$sSearchStr)

 # Looking for the group
 $oFindResult = $oSearch.FindAll()

 # On success, get a DirectoryEntry object for the group
 $oGroup = New-Object System.DirectoryServices.DirectoryEntry($oFindResult.Path)


 # And list all members
 If (($oGroup.Member).Count -ge 1) 
 
 %($oMembers = New-Object System.DirectoryServices.DirectoryEntry($sLDAPSearchRoot+"/"+$_))
 
 Else
 Write-Warning -Message "$($oGroup.Member) does not exist or has no members"