使用来自多个组的用户从 AD 中提取数据并在 Export-CSV 中显示这些组

Question

Goal: To create an Export-CSV file with data formatted so that it can be imported into another program. The data file includes UIDNumber, GivenName, SurName, Record Type, Custom Field 1, Custom Value 1, End. The "Custom Field 1" and "End" are filler text that are specific to my department.

"Custom Value 1" is where I'm having issues. I need to get the users then determine which groups they are in and assign those group names to "Custom Value 1" pipe delimited. Here's what the output should look like:

Employee ID,  First Name,  Last Name, Record Type, Custom Field 1, Custom Value 1, End

123456,       John, Doe, employee, ADGroup-MSelectionList, REF_USERS | PC_USERS,   End

I realize my code is over done and slow, but I'm learning. I have had many thoughts of how to get the user associations out of each group and build out the needed field, just not sure how to get there.

Here's my code:

# Var
$LocalVar1 = 'USERGroup1'    
$LocalVar2 = 'USERGroup2'    
$LocalVar3 = 'USERGroup3'

$Field1 = 'ADGroup-MSelectionList'

$Field2 = 'END'

# Getting the members of each group into one container

$Allusers1 = Get-ADGroupMember -Identity $LocalVar1 | ? {$_.objectclass -eq "user" } | Foreach-Object ({ Get-ADUser $($_.samaccountname) -Properties * }) | ? {$_.enabled -eq $True} | Select @{Name="Employee ID";Expression={$_.UIDNumber}}    

$Allusers2 = Get-ADGroupMember -Identity $LocalVar2 | ? {$_.objectclass -eq "user" } | Foreach-Object ({ Get-ADUser $($_.samaccountname) -properties * }) | ? {$_.enabled -eq $True} | Select @{Name="Employee ID";Expression={$_.UIDNumber}}    

$Allusers3 = Get-ADGroupMember -Identity $LocalVar3 | ? {$_.objectclass -eq "user" } | Foreach-Object ({ Get-ADUser $($_.samaccountname) -properties * }) | ? {$_.enabled -eq $True} | Select @{Name="Employee ID";Expression={$_.UIDNumber}}

# Putting all the users in one basket
$Allusers = $AllUsers1 + $Allusers2 + $Allusers3

# Removing all of the duplicate users
$Allusers | Sort "Employee_ID" -unique

# Getting the individual users out of each group with required data

$users1 = Get-ADGroupMember -Identity $LocalVar1 | ? {$_.objectclass -eq "user" } | Foreach-Object ({ Get-ADUser $($_.samaccountname) -properties * }) | ? {$_.enabled -eq $True} | Select @{Name="Employee ID";Expression={$_.UIDNumber}},@{Name="First Name";Expression={$_.GivenName}},@{Name="Last Name";Expression={$_.SurName}},@{Name="Record Type";Expression={"Employee"}},
@{Name="Custom Field 1";Expression={$Field1}},@{Name="Custom Value 1";Expression={$LocalVar1}},@{Name="END";Expression={$Field2}}

$users2 = Get-ADGroupMember -Identity $LocalVar2 | ? {$_.objectclass -eq "user" } | Foreach-Object ({ Get-ADUser $($_.samaccountname) -properties * }) | ? {$_.enabled -eq $True} | Select @{Name="Employee ID";Expression={$_.UIDNumber}},@{Name="First Name";Expression={$_.GivenName}},@{Name="Last Name";Expression={$_.SurName}},@{Name="Record Type";Expression={"Employee"}},
@{Name="Custom Field 1";Expression={$Field1}},@{Name="Custom Value 1";Expression={$LocalVar2}},@{Name="END";Expression={$Field2}}

$users3 = Get-ADGroupMember -Identity $LocalVar3 | ? {$_.objectclass -eq "user" } | Foreach-Object ({ Get-ADUser $($_.samaccountname) -properties * }) | ? {$_.enabled -eq $True} | Select @{Name="Employee ID";Expression={$_.UIDNumber}},@{Name="First Name";Expression={$_.GivenName}},@{Name="Last Name";Expression={$_.SurName}},@{Name="Record Type";Expression={"Employee"}},
@{Name="Custom Field 1";Expression={$Field1}},@{Name="Custom Value 1";Expression={$LocalVar3}},@{Name="END";Expression={$Field2}}

# This is my started attempt to get what I want, but had no luck.
Foreach ($Employee_ID in $Allusers) {    
              Where-Object($User1 -eq $Allusers) 
       } 

Answer 1

Beyond what's stated you're almost certainly having issues because you are using ForEach-Object incorrectly. You should read up on the differences between ForEach and ForEach-Object, as you are using the former's syntax in a pipeline which is incorrect.

Docs ForEach-Object

About_ForEach

I'd point out a ForEach-Object Loop isn't needed in this case. Get-ADUser can take the output from Get-ADGroupMember` directly through the pipeline. For example, a refactored segment of your code:

$Allusers1 = Get-ADGroupMember -Identity $LocalVar1 | 
Where-Object { $_.objectclass -eq "user" } | 
Get-ADUser -Properties *  | 
Where-Object { $_.Enabled } | 
Select-Object @{Name = "Employee ID"; Expression = { $_.UIDNumber }} 

An aside: Notice the formatting difference...

Note: You only selected the custom/calculated property you defined. $AllUsers1 will be an array of objects with only the single property "Employee ID".

Note: Try to avoid -Properties * it's usually overkill. Instead give -Properties an array argument with the additional properties you are interested in, in your case that might be something like -Properties "UIDNumber" .

As far as the core question, which I think is how to get a pipe-delimited field of a given user's groups. I can't re-work what you've posted, but I can give a concept sample:

$users1 = Get-ADGroupMember -Identity $LocalVar1 | 
Where-Object { $_.objectclass -eq "user" } |  
Get-ADUser $($_.samaccountname) -properties * | 
Where-Object {$_.enabled -eq $True} | 
Select-Object @{Name = "Employee ID"; Expression = { $_.UIDNumber }},
    @{Name = "First Name"; Expression = { $_.GivenName }},
    @{Name = "Last Name"; Expression = { $_.SurName }},
    @{Name = "Record Type"; Expression = { "Employee" }},
    @{Name = "Custom Field 1"; Expression = { $Field1 }},
    @{Name = "Custom Value 1"; Expression = { ( (Get-ADPrincipalGroupMembership $_.samAccountName).Name -join "|" ) }},
    @{Name = "END"; Expression = { $Field2 }}

Again, this isn't production worthy. It's meant to demonstrate a concept. The key piece is you are taking the user's group memberships, actually an array of those Name properties, and joining them on the pipe character.

Once that's done you still need to send the data to a CSV file. Continuing this example:

$users1 | Export-Csv C:\Temp\Users1.csv -NoTypeInformation

An aside: You really should work on formatting your code better. At a minimum, you should line break on the pipe character. For calculated properties, I either pre-write them and store them in an array or put each one on a new line as I have in the examples. There are lots of resources you can use for guidance on that. For example, the PowerShell Community maintains the "The PowerShell Best Practices and Style Guide" .

Answer 2

Here's my updated code. I'm still working on improvements and have cut out about half of my original programming with the IF statement for EmployeeType. I created a small -replace code in a separate script to place the "|" between each group. I'm also reviewing all of the links you provided and they are a great help.

# Local Variables
$LocalVar1 = 'Group_1_USERS'
$LocalVar2 = 'Group_2_USERS'
$LocalVar3 = 'Group_3_USERS'

$Field1 = 'ADGroup-MSelectionList'
$Field2 = 'END'

# Going through each group to get extract users
$users1 = Get-ADGroupMember -Identity $LocalVar1 | 
    ? {$_.objectclass -eq "user"} | 
        Foreach-Object ({ Get-ADUser $($_.samaccountname) -properties SamAccountName, Enabled }) | 
            ? {$_.enabled -eq $True} | 
            Select @{Name="SamAccountName";Expression={$_.SamAccountName}}

$users2 = Get-ADGroupMember -Identity $LocalVar2 | 
    ? {$_.objectclass -eq "user"} | 
        Foreach-Object ({ Get-ADUser $($_.samaccountname) -properties SamAccountName, Enabled }) | 
            ? {$_.enabled -eq $True} | 
            Select @{Name="SamAccountName";Expression={$_.SamAccountName}}

$users3 = Get-ADGroupMember -Identity $LocalVar3 | 
    ? {$_.objectclass -eq "user"} | 
        Foreach-Object ({ Get-ADUser $($_.samaccountname) -properties SamAccountName, Enabled }) | 
            ? {$_.enabled -eq $True} | 
            Select @{Name="SamAccountName";Expression={$_.SamAccountName}}
            
# Putting all the users in one basket, Sort the users and remove
$Data = $Users1 + $users2 + $users3 | Sort "SamAccountName" -Unique

# Extracting, Formatting and Output
$Data | Foreach ({ Get-ADUser $($_.samaccountname) -properties EmployeeType, UIDNumber, GivenName, SurName, SamAccountName }) | 
    Select-Object @{Name="Employee ID";Expression={$_.UIDNumber}},
        @{Name="First Name";Expression={$_.GivenName}},
        @{Name="Last Name";Expression={$_.SurName}},
        @{Name="Record Type";Expression={ If ($_.EmployeeType -eq "E") {"Employee"} else {"Contractor"}}},
        @{Name="Custom Field 1";Expression={$Field1}},
        @{Name="Custom Value 1";Expression={ ( (Get-ADPrincipalGroupMembership $_.samAccountName).Name | 
            Where-Object {$_ -Like "Group_*_USERS"})}},
        @{Name="END";Expression={$Field2}}|

Export-CSV -Path "W:\$((Get-Date).ToString("yyyyMMdd_hh"))_File.csv" -NoTypeInformation