Adding a PC to a Security Group in AD via Powershell without having to install RSAT

Question

a few weeks ago I started setting up my MDT(Microsoft Deployment Toolkit) custom Image. Nearly everything works fine so far except my recent Powershell script which is meant for adding a computer to a specific security group without RSAT Tools. I tested it on a newly installed OS but I keep on getting the Exception as in the Powershell Exception link shown below. I'm not really into Powershell programming and I tested several scripts to get it to work and I ended up with this one but I think I didn't fully get the hang of it.

Any help/advice or alternative is highly appreciated :).

My Powershell Code:

<#
PowerShell to join computer object to Active Directory Group without AD module being imported
This finds the computer object anywhere in AD and adds it to a security group in a known location
#>

#Get computer name
 $ComputerName = gc env:computername

#Check to see if computer is already a member of the group
 $isMember = new-object DirectoryServices.DirectorySearcher([ADSI]"NameofMYSecurityGroup")
 $ismember.filter = “(&(objectClass=computer)(sAMAccountName= $Computername$)(memberof=CN=Computers,DC=MY_DOMAIN,DC=LOCAL))”
 $isMemberResult = $isMember.FindOne()

#If the computer is already a member of the group, just exit.
 If ($isMemberResult) {exit}

else
#If the computer is NOT a member of the group, add it.
{
   $searcher = new-object DirectoryServices.DirectorySearcher([ADSI]"NameofMYSecurityGroup")
   $searcher.filter = “(&(objectClass=computer)(sAMAccountName= $Computername$))”
   $FoundComputer = $searcher.FindOne()
   $P = $FoundComputer | select path
   $ComputerPath = $p.path
   $GroupPath = "LDAP://CN=Computers,DC=MY_DOMAIN,DC=LOCAL"
   $Group = [ADSI]"$GroupPath"
   $Group.Add("$ComputerPath")
   $Group.SetInfo()
}

it's german by the way but it basically says:

Exception calling "Add" with 1 Arguments: "Unknown Name. (Exception From HRESULT: 0x80020006 (DISP_E_UNKNOWNNAME))
AT F:\"SourcePath"
+    $Group.Add("$ComputerPath")

     +CategoryInfo          :NotSpecified: (:) [], MethodInvocationException
     +FullyQuallifiedErrord :CatchFromBaseAdapterMethodInvoke

Exception Link:

Powershell Exception

Shouldn't that be `[string]$ComputerPath = $searcher.FindOne().Properties.adspath`? Then add to the group without the quotes: `$Group.Add($ComputerPath)` — Theo, Jul 24 '21 at 18:45
I was still getting the same Exception. Do I have to type the [string] before $Computerpath? — Merick00, Jul 26 '21 at 05:49

score 0 · Answer 1 · answered Jul 26 '21 at 15:06

Untested, but this may help you in the right direction:

$ComputerName = $env:COMPUTERNAME
$GroupDN      = 'CN=Computers,DC=MY_DOMAIN,DC=LOCAL'

# initialize the DirectorySearcher
$root     = New-Object System.DirectoryServices.DirectoryEntry("LDAP://RootDSE")
$searcher = New-Object System.DirectoryServices.DirectorySearcher($root.defaultNamingContext)
$searcher.SearchScope = 'SubTree'

# Check to see if computer is already a member of the group
$searcher.Filter = "(&(objectCategory=Computer)(objectClass=User)(samaccountname=$ComputerName$)(memberof=$GroupDN))"
$isMember = $searcher.FindOne()

# If the computer is already a member of the group, just exit.
if ($isMember) { exit }

# get the computer object
$searcher.Filter = "(&(objectCategory=Computer)(objectClass=User)(samaccountname=$ComputerName$))"
$ComputerDN      = $searcher.FindOne().Properties['distinguishedname']
$ComputerObject  = [ADSI]"LDAP://$ComputerDN"

# get the group object
$GroupObject = [ADSI]"LDAP://$GroupDN"

# add the computer to the group
$GroupObject.Add($ComputerObject.AdsPath)
# no need for this $Group.SetInfo()

I figured it out :) the grouppath wasn't pointing to the location where the security group is, it was just pointing to the OU=Computers. Thanks anyway for the help :) — Merick00, Jul 27 '21 at 16:11

Adding a PC to a Security Group in AD via Powershell without having to install RSAT

1 Answers1