Sync an Active Directory Group with a SharePoint Group

Have you ever wanted to keep the members of a SharePoint group in sync with those of an Active Directory Group?

If so, you’re in luck, I happen to have just such as script.

Just a quick note, this was written for and tested on a 2010 site – in 2013, the default authentication is Claims – those funny looking strings like this: “i:0#.w|domain\user” (more info here) and you’ll need to work this script over a few times to make that work.

That said, this script will keep a SharePoint group in sync with an AD group.

The AD group is considered the “master”

That is to say, if the AD group has extra users that aren’t in SharePoint, they will be added to SharePoint.

If a user is removed from the AD group, they will also be removed from the SharePoint Group.

If a user is added to the SP Group, but isn’t in the AD group? They will be removed from the SP group.

This is one of those scripts that makes sense to run as a scheduled task once you get it working.  If you need help with that, see my post: Schedule your PowerShell scripts using the Windows task scheduler.

Now for a friendly reminder and some advice…
#1) Always test code you find online before using it in production…
#2) when you test this code, follow this advice:

Testing this code

When you test the code, you might make a mistake I made during development – I’ll share that mistake with you to save you an hour of time and some frustration.

Here’s what I did…

While testing, I wanted to try adding users to an AD group and wanted to make sure they added in correctly.

For one test I wanted to remove ALL the users from the SharePoint Group, and confirm that they came back ok.

To do this I used the UI to remove all the users – I checked each user, then clicked “actions->remove users from group” like this:
removeusersscreenSP2010

I then ran my Super Awesome AD Sync PowerShell Script which Added the groups back in.

Now here’s where it got ugly.

When I checked the UI, they weren’t there.

In fact, if I ran the powershell script again it indicated that they were being added back a second time (the script should have told me there was nothing to change!)

What was the cause?

It was my use of the refresh button…refresh in IE

Recall that the very last thing I did was remove users using that screen.

Now interestingly, you know how we all click “OK” on a screen without paying attention?

After I hit refresh, I got this, and ignored it:
dialogIshouldhaveread

See what I did there?

I was refreshing the delete in the UI!

Don’t make that mistake!

Instead of clicking the refresh button, it’s easier (and safer) to click the group name on the left:
dontclickrefreshwhenyoudelete

Lessons learned:

  • Pay attention to dialog boxes, they may save you an hour.
  • Don’t ever click ‘refresh’ after performing a delete!

 

4 thoughts on “Sync an Active Directory Group with a SharePoint Group

  1. Hi Jack- thank you for the great site and the fantastic SP/AD synch script. I just wondered if there is something like this possible for sharepoint online – Powershell online management as many of the cmdlets for onprem are not available for online but thought it worth asking if something similar is possible. Thank you for any help/advice you can give.

    Regards

    Adam

    1. Hi Adam, I believe so, there are a few commandlets for adding users to a sharepoint online site/group, and I think you can enumerate through the current group users similar to how we do it on premise, (using the appropriate SPO commands). I’ve not done this yet, but if I do, I’ll be sure to update the site.

    1. Hi Drag, sorry for the late reply.
      As I understand it, the script above works with claims with a slight modification to take into account the structure of the claim.
      I’ve not needed it but a peer at another company said he was able to alter it pretty quickly to work with claims ID’s instead of Domain\userID.

Leave a Reply