0

I have a PS script in a startup GPO (computer). This script moves some AD objects on OU and Security Group depending on the computer name.

For example, a computer name starting by P113301 will be member of a specific security group. And it moves to a specific OU depending of the IP (OU represents physical sites)

My script works like a charm locally on every computer, but not in the GPO. I think this is because the GPO is launch by local account and have no right on the domain.

I tried to change credentials (specific with elevated rights on domain), and it works again locally but not by GPO again.

My script is here. Have you an idea what i can do to make it work, or pearhaps have you an idea to achieve my goal. For information : no way for me to use GPO logon user, i want the process to start when the computer is turned on

$IP = $NULL
$ComputerName = $NULL
$CompObj = $NULL
$ComputerOU = $NULL
$ComputerDN = $NULL
$DestinationDN = $NULL


$GSFIXES = "CN=balbalbal_fixes, DC=balbla,DC=local"
$GSLAPTOPS = "CN=balbalbal_laptops, DC=balbla,DC=local"


$BIGANOSIPRange = "\b(?:(?:192)\.\b(?:(?:168)\.)\b(?:(?:36)\.|\b(?:(?:37)\.|\b(?:(?:38)\.|\b(?:(?:39))))))"
$SIEGEIPRange = "\b(?:(?:192)\.\b(?:(?:168)\.)\b(?:(?:4)\.|\b(?:(?:5)\.|\b(?:(?:6)\.|\b(?:(?:7))))))"


$BIGANOSDN = "OU=BIGANOS,DC=balbla,DC=local"
$SIEGEDN = "OU=SIEGE,DC=balbla,DC=local"


    $versionOS = (Get-WmiObject Win32_OperatingSystem).Version
    if ($versionOS.StartsWith("10")) {


    trap [System.Net.Sockets.SocketException] { continue; }


    $ComputerName = [system.environment]::MachineName
    $ComputerDN = ([ADSISEARCHER]”sAMAccountName=$($env:COMPUTERNAME)$”).FindOne().Path
    $CompObj = [ADSI]”$ComputerDN”
    $ComputerOU = ($ComputerDN -split $ComputerName + ",")[-1]


    $FixesMember = new-object DirectoryServices.DirectorySearcher([ADSI]"")
    $Fixesmember.filter = “(&(objectClass=computer)(sAMAccountName=$Computername$)(memberof=$GSFIXES))”
    $FixesMemberResult = $Fixesmember.FindOne()
    $LaptopsMember = new-object DirectoryServices.DirectorySearcher([ADSI]"")
    $Laptopsmember.filter = “(&(objectClass=computer)(sAMAccountName=$Computername$)(memberof=$GSLAPTOPS))”
    $LaptopsMemberResult = $Laptopsmember.FindOne()

    if (($FixesMemberResult) -OR ($LaptopsMemberResult))
    {}
    Else {
    if ($ComputerName.StartsWith("S113301"))  {
    $group = [ADSI]”LDAP://$($GSFIXES)”
    $machine = [ADSI]$ComputerDN
    $group.Add($machine.Path)
    }
    if ($ComputerName.StartsWith("P113301"))  {
    $group = [ADSI]”LDAP://$($GSLAPTOPS)”
    $machine = [ADSI]$ComputerDN
    $group.Add($machine.Path)
    }
    }

    $IP = Get-WmiObject Win32_NetworkAdapterConfiguration -Filter 'IPEnabled=TRUE' | Select-Object -ExpandProperty IPAddress | Where-Object { $_ -notlike "192.*" -and $_ -notlike "169.*" -and $_ -notlike "127.*" -and $_ -notlike "10.*" -and $_ -notlike "172.*" -and $_ -notlike "*:*"} | Select -First 1

    if ($IP -match $BIGANOSIPRange) {
        $DestinationDN = $BIGANOSDN
    }
    ElseIf ($IP -match $SIEGEIPRange) {
        $DestinationDN = $SIEGEDN
    }
    Else {

        $DestinationDN = $ComputerOU    
    }

    if ($IP -ne $NULL) {
    $CompObj.psbase.MoveTo([ADSI]”LDAP://$($DestinationDN)”)
    }
    }
Yann Di Maggio
  • 21
  • 2
  • You have not said how you have this configured in the GPO. PowerShell will always run in the context of the user who started it. Are you saying you are doing this as a logon script, etc.? Of course, you have to run powershell.exe/pwsh.exe with your script name to run any script. You can use GPO to deploy the script to a target host and use a scheueld task to run it and delete itself when it is done. – postanote Mar 11 '20 at 17:08
  • You might be right about the AD credentials of the local account but there is also another pitfall in this scenario: [Windows Fast Logon Optimization and Fast Startup](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj573586(v%3Dws.11)). In a few words: the network might not be available for minutes after your startup script is executed. Anyways, to troubleshoot this and separate the two potential issues, have a look at: [Scheduled Task Powershell Script - Runs OK as user account, but not as SYSTEM](https://stackoverflow.com/a/51612478/1701026) – iRon Mar 11 '20 at 19:04
  • Thank you for your answers but : - My GPO is startup script and it doesn'y not execute in a users's context - My startup GPO has parameters activated to wait the network before execution – Yann Di Maggio Mar 13 '20 at 11:21

0 Answers0