PowerShell don't copy “MemberOf” based on CSV exclusions list

Question

I have a csv that contains security groups that should never be copied when creating or modifying user accounts within Active Directory. It looks like this:

securityGroup
"CN=Security Group 1,OU=Security Groups,DC=domain,DC=com", "CN=Security Group 2,OU=Security Groups,DC=domain,DC=com", "CN=Security Group 3,OU=Security Groups,DC=domain,DC=com", "CN=Security Group 4,OU=Security Groups,DC=domain,DC=com"

When copying AD groups, we use the following method:

$userName = [User which security groups are copied TO]
$modelUser = [User which security groups are copied FROM]
$modelMember = Get-ADUser $modelUser -Properties MemberOf
$modelMember.MemberOf | Add-ADGroupMember -Members $userName

What we would like to see is that no groups from the above CSV file are copied from a model user to another user. I have had some success by manually entering Security Groups over and over again using "-and" and "-not contains" in the script but would prefer to use a CSV instead.

$modelMember.MemberOf | Where{$_ -notcontains "CN=Security Group 1,OU=Security Groups,DC=domain,DC=com" -and $_ -notcontains "CN=Security Group 2,OU=Security Groups,DC=domain,DC=com" -and $_ -notcontains "CN=Security Group 3,OU=Security Groups,DC=domain,DC=com" -and $_ -notcontains "CN=Security Group 4,OU=Security Groups,DC=domain,DC=com"} | Add-ADGroupMember -Members $userName

I guess I don't even know where to begin. Any help would be greatly appreciated!

Answer 1

The file you show does not look like a CSV, those are groups one-per-line rather than comma-separated.

It's easy enough as long as you have PowerShell v3 or above:

$modelMember = Get-ADUser $modelUser -Properties memberOf

$forbiddenGroups = Get-Content groupList.txt
$modelGroups = $modelMember.MemberOf | Where-Object { $_ -notin $forbiddenGroups } 

$modelGroups | Add-ADGroupMember -Members $userName

---

Auto-generated PS help links from my codeblock (if available):

• Get-ADUser (in module ActiveDirectory )
• Get-Content (in module Microsoft.PowerShell.Management )
• Where-Object
• Add-ADGroupMember (in module ActiveDirectory )