Im looking for a way to identify users who are member of one of few groups (a,b,c) but also are not in a specific group (d), an exception group, to later on perform some tasks on them (filling in specific attribute based on value of samaccountname).
For now, I managed to list user accounts who are member of specific group and follow another condition of having smart card enforcement as false:
$groups = "a","b","c"
foreach ($group in $groups) {
Get-ADGroupMember -Identity $group |
Get-ADUser -Properties 'smartcardlogonrequired' |
where {$_.smartcardlogonrequired -eq $false}
}
I thought of following. Defining group of exceptions by
$exceptions = (Get-ADGroup 'd').distinguishedname
foreach ($group in $groups) {
Get-ADGroupMember -Identity $group |
Get-ADUser -Properties 'smartcardlogonrequired' |
where {$_.smartcardlogonrequired -eq $false} |
Get-ADUser –Filter {-not(memberof –eq $d}
}
However, it doesn't really do the trick, and im sure theres a better way.