Hello -
I have a script that adds enabled user accounts for employees that are not already members of a group. I'd like to add a check for deprovision status and filter out employees that are enabled but have been deprovisioned.
I filter active users that are already members and identify those that need to be added using the following script block:
$NotMemberOf = 'Group 1', 'Group 2', 'Group 3'
$ModifiedThisWeek = (Get-Date).AddDays(-7)-
$UserList = Get-QADUser -Enabled -NotMemberOf $NotMemberOf -DontUseDefaultIncludedProperties -IncludeProperties Name, samAccountName, employeeID, City, ModificationDate -SizeLimit 0 |
Where-Object {$_.employeeID -ne $Null -and ($_.City -ne 'City 1' -and $_.City -ne 'City 2') -and $_.ModificationDate -gt $ModifiedThisWeek | Sort-Object Name | Select-Object Name, samAccountName, employeeID, City, ModificationDate
ForEach ($User in $UserList) {Add-QADGroupMember -Identity 'Group 4' -Member $User.samAccountName
I've been reading forums, KB articles and doing some testing. I'm aware of KB4377955 and issues with using edsvaDeprovisionStatus in versions 8.2 and 8.2.1 (we're running 8.1.3). I've found that I have to add -Proxy to any attempt the filter for edsvaDeprovisionStatus, but what gets returned for other included attributes is not consistent with what gets returned without -Proxy.
I'd like to find a way to filter any enabled user that is also deprovisioned in one command if possible. Any suggestions you have would be appreciated.