{"id":208416,"date":"2024-01-22T10:48:37","date_gmt":"2024-01-22T10:48:37","guid":{"rendered":"https:\/\/www.ninjaone.com\/script-hub\/ajouter-ou-supprimer-des-utilisateurs-active-directory\/"},"modified":"2024-03-04T19:05:17","modified_gmt":"2024-03-04T19:05:17","slug":"ajouter-ou-supprimer-des-utilisateurs-active-directory","status":"publish","type":"script_hub","link":"https:\/\/www.ninjaone.com\/fr\/script-hub\/ajouter-ou-supprimer-des-utilisateurs-active-directory\/","title":{"rendered":"Utiliser Powershell pour ajouter ou supprimer des utilisateurs Active Directory et des groupes d’ordinateurs locaux"},"content":{"rendered":"

La gestion et la modification de l’appartenance des utilisateurs \u00e0 des groupes (ajouter ou supprimer des utilisateurs) <\/strong>que ce soit sur une machine locale ou dans Active Directory, est une t\u00e2che courante pour les professionnels de l’informatique. Une gestion efficace de ces op\u00e9rations peut grandement am\u00e9liorer l’administration du syst\u00e8me, en simplifiant les processus et en \u00e9vitant les erreurs. Le pouvoir des scripts prend tout son sens dans ce contexte, car il permet l’automatisation et la pr\u00e9cision.<\/p>\n

Contexte<\/h2>\n

Le script fourni plonge dans l’essence m\u00eame de la gestion informatique en permettant aux administrateurs d’ajouter ou supprimer des utilisateurs de groupes sp\u00e9cifiques. Il est con\u00e7u pour \u00eatre polyvalent, fonctionnant \u00e0 la fois dans le domaine d’un ordinateur local et dans Active Directory. Au fur et \u00e0 mesure que les entreprises et les fournisseurs de services g\u00e9r\u00e9s (MSP) se d\u00e9veloppent, la gestion manuelle des utilisateurs peut devenir tr\u00e8s compliqu\u00e9e. Ces scripts permettent non seulement de r\u00e9duire le temps consacr\u00e9 aux t\u00e2ches de routine, mais aussi de minimiser les erreurs humaines.<\/p>\n

Le script<\/h2>\n
#Requires -Version 2.0\r\n\r\n<#\r\n.SYNOPSIS\r\n    Add or remove a user to a group in Active Directory or the local computer.\r\n.DESCRIPTION\r\n    Add or remove a user to a group in Active Directory or the local computer.\r\n.EXAMPLE\r\n     -Group \"MyGroup\" -UserName \"MyUser\" -Action Add -IsDomainUser\r\n    Adds MyUser to the group MyGroup in AD.\r\n.EXAMPLE\r\n     -Group \"MyGroup\" -UserName \"MyUser\" -Action Remove -IsDomainUser\r\n    Removes MyUser from the group MyGroup in AD.\r\n.EXAMPLE\r\n     -Group \"MyGroup\" -UserName \"MyUser\" -Action Add\r\n    Adds MyUser to the group MyGroup on the local computer.\r\n.EXAMPLE\r\n    PS C:> Modify-User-Membership.ps1 -Group \"MyGroup\" -UserName \"MyUser\" -Action Remove\r\n    Removes MyUser from the group MyGroup on the local computer.\r\n.OUTPUTS\r\n    String[]\r\n.NOTES\r\n    Minimum OS Architecture Supported: Windows 7, Windows Server 2012\r\n    This will require RSAT with the AD feature to be installed to function.\r\n    Release Notes:\r\n    Initial Release\r\nBy using this script, you indicate your acceptance of the following legal terms as well as our Terms of Use at https:\/\/www.ninjaone.com\/terms-of-use.\r\n    Ownership Rights: NinjaOne owns and will continue to own all right, title, and interest in and to the script (including the copyright). NinjaOne is giving you a limited license to use the script in accordance with these legal terms. \r\n    Use Limitation: You may only use the script for your legitimate personal or internal business purposes, and you may not share the script with another party. \r\n    Republication Prohibition: Under no circumstances are you permitted to re-publish the script in any script library or website belonging to or under the control of any other software provider. \r\n    Warranty Disclaimer: The script is provided \u201cas is\u201d and \u201cas available\u201d, without warranty of any kind. NinjaOne makes no promise or guarantee that the script will be free from defects or that it will meet your specific needs or expectations. \r\n    Assumption of Risk: Your use of the script is at your own risk. You acknowledge that there are certain inherent risks in using the script, and you understand and assume each of those risks. \r\n    Waiver and Release: You will not hold NinjaOne responsible for any adverse or unintended consequences resulting from your use of the script, and you waive any legal or equitable rights or remedies you may have against NinjaOne relating to your use of the script. \r\n    EULA: If you are a NinjaOne customer, your use of the script is subject to the End User License Agreement applicable to you (EULA).\r\n.COMPONENT\r\n    ManageUsers\r\n#>\r\n\r\n[CmdletBinding()]\r\nparam (\r\n    # Specify one Group\r\n    [Parameter(Mandatory = $true)]\r\n    [String]\r\n    $Group,\r\n    # Specify one User\r\n    [Parameter(Mandatory = $true)]\r\n    [String]\r\n    $UserName,\r\n    # Add or Remove user from group\r\n    [Parameter(Mandatory = $true)]\r\n    [ValidateSet(\"Add\", \"Remove\")]\r\n    [String]\r\n    $Action,\r\n    # Modify a domain user's membership\r\n    [Parameter(Mandatory = $false)]\r\n    [Switch]\r\n    $IsDomainUser\r\n)\r\n\r\nbegin {\r\n    function Test-IsElevated {\r\n        $id = [System.Security.Principal.WindowsIdentity]::GetCurrent()\r\n        $p = New-Object System.Security.Principal.WindowsPrincipal($id)\r\n        if ($p.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator))\r\n        { Write-Output $true }\r\n        else\r\n        { Write-Output $false }\r\n    }\r\n}\r\n\r\nprocess {\r\n    if (-not (Test-IsElevated)) {\r\n        Write-Error -Message \"Access Denied. Please run with Administrator privileges.\"\r\n        exit 1\r\n    }\r\n    if (-not $IsDomainUser) {\r\n        # Modify Local User\r\n        if ($Action -like \"Remove\") {\r\n            if ($PSVersionTable.PSVersion.Major -lt 3) {\r\n                # Connect to localhost\r\n                try {\r\n                    $ADSI = [ADSI](\"WinNT:\/\/$env:COMPUTERNAME\")\r\n                }\r\n                catch {\r\n                    Write-Error -Message \"Failed to connect to $env:COMPUTERNAME via ADSI object\"\r\n                    exit 1\r\n                }\r\n                # Find the group\r\n                try {\r\n                    $ASDIGroup = $ADSI.Children.Find($Group, 'group')\r\n                }\r\n                catch {\r\n                    Write-Error -Message \"Failed to find $Group via ADSI object\"\r\n                    exit 1\r\n                }\r\n                # Remove the user from the group\r\n                try {\r\n                    $ASDIGroup.Remove((\"WinNT:\/\/$env:COMPUTERNAME\/$UserName\"))\r\n                }\r\n                catch {\r\n                    Write-Error -Message \"Failed to remove User $UserName from Group $Group\"\r\n                    exit 529 # ERROR_MEMBER_NOT_IN_GROUP\r\n                }\r\n                \r\n            }\r\n            else {\r\n                if (\r\n                    # Check that the group exists\r\n                (Get-LocalGroup -Name $Group -ErrorAction SilentlyContinue) -and\r\n                    # Check that the user exists in the group\r\n                (Get-LocalGroupMember -Group $Group -Member $UserName -ErrorAction SilentlyContinue)\r\n                ) {\r\n                    Write-Output \"Found $UserName in Group $Group, removing.\"\r\n                    try {\r\n                        # Remove user from Group, -Confirm:$false used to not prompt and stop the script\r\n                        Remove-LocalGroupMember -Group $Group -Member $UserName -Confirm:$false\r\n                        Write-Output \"Removed User $UserName from Group $Group\"\r\n                    }\r\n                    catch {\r\n                        Write-Error -Message \"Failed to remove User $UserName from Group $Group\"\r\n                        exit 529 # ERROR_MEMBER_NOT_IN_GROUP\r\n                    }\r\n                }\r\n                elseif (-not (Get-LocalGroup -Name $Group -ErrorAction SilentlyContinue)) {\r\n                    Write-Error -Message \"Group $Group does not exist\"\r\n                    exit 528 # ERROR_NO_SUCH_GROUP\r\n                }\r\n                elseif (-not (Get-LocalGroupMember -Group $Group -Member $UserName -ErrorAction SilentlyContinue)) {\r\n                    Write-Error -Message \"User does not exist in Group $Group\"\r\n                    exit 529 # ERROR_MEMBER_NOT_IN_GROUP\r\n                }\r\n            }\r\n            \r\n        }\r\n        elseif ($Action -like \"Add\") {\r\n            if ($PSVersionTable.PSVersion.Major -lt 3) {\r\n                # Connect to localhost\r\n                try {\r\n                    $ADSI = [ADSI](\"WinNT:\/\/$env:COMPUTERNAME\")\r\n                }\r\n                catch {\r\n                    Write-Error -Message \"Failed to connect to $env:COMPUTERNAME via ADSI object\"\r\n                    exit 1\r\n                }\r\n                # Find the group\r\n                try {\r\n                    $ASDIGroup = $ADSI.Children.Find($Group, 'group')\r\n                }\r\n                catch {\r\n                    Write-Error -Message \"Failed to find $Group via ADSI object\"\r\n                    exit 1\r\n                }\r\n                # Get the members of the group\r\n                $GroupResults = try {\r\n                    $ASDIGroup.psbase.invoke('members')  | ForEach-Object {\r\n                        $_.GetType().InvokeMember(\"Name\", \"GetProperty\", $Null, $_, $Null)\r\n                    }\r\n                }\r\n                catch {\r\n                    $null\r\n                }\r\n                # Check if the user is in the group\r\n                if ($UserName -in $GroupResults) {\r\n                    # User already in Group\r\n                    Write-Output \"User $UserName already in Group $Group\"\r\n                    exit 1320 # ERROR_MEMBER_IN_GROUP\r\n                }\r\n                else {\r\n                    # User not in group, add them to the group\r\n                    try {\r\n                        $ASDIGroup.Add((\"WinNT:\/\/$env:COMPUTERNAME\/$UserName\"))\r\n                    }\r\n                    catch {\r\n                        Write-Error -Message \"Failed to add User $UserName to Group $Group\"\r\n                        exit 1388 # ERROR_INVALID_MEMBER\r\n                    }\r\n                    \r\n                    # We can verify the membership by running the following  command:\r\n                    if ($UserName -in (\r\n                            $ASDIGroup.psbase.invoke('members')  | ForEach-Object {\r\n                                $_.GetType().InvokeMember(\"Name\", \"GetProperty\", $Null, $_, $Null)\r\n                            }\r\n                        )\r\n                    ) {\r\n                        # User in Group\r\n                        Write-Output \"Added User $UserName to Group $Group\"\r\n                    }\r\n                    else {\r\n                        Write-Error -Message \"Failed to add User $UserName to Group $Group\"\r\n                        exit 1388 # ERROR_INVALID_MEMBER\r\n                    }\r\n                }\r\n                \r\n            }\r\n            else {\r\n                # Verify that the user and group exist\r\n                if (\r\n                    # Check that the user exists\r\n                (Get-LocalUser -Name $UserName -ErrorAction SilentlyContinue) -and\r\n                    # Check that the group exists\r\n                (Get-LocalGroup -Name $Group -ErrorAction SilentlyContinue)\r\n                ) {\r\n                    # Check if user is already in group\r\n                    if (-not (Get-LocalGroupMember -Group $Group -Member $UserName -ErrorAction SilentlyContinue)) {\r\n                        # User not in group, good to add\r\n                        try {\r\n                            # Add user to group\r\n                            Add-LocalGroupMember -Group $Group -Member (Get-LocalUser -Name $UserName)\r\n                            Write-Output \"Added User $UserName to Group $Group\"\r\n                        }\r\n                        catch {\r\n                            Write-Error -Message \"Failed to add User $UserName to Group $Group\"\r\n                            exit 1388 # ERROR_INVALID_MEMBER\r\n                        }\r\n                    }\r\n                    else {\r\n                        # User already in Group\r\n                        Write-Output \"User $UserName already in Group $Group\"\r\n                        exit 1320 # ERROR_MEMBER_IN_GROUP\r\n                    }\r\n                \r\n                }\r\n            }\r\n        }\r\n    }\r\n    else {\r\n        if ((Get-Module -Name ActiveDirectory -ListAvailable -ErrorAction SilentlyContinue)) {\r\n            try {\r\n                Import-Module -Name ActiveDirectory\r\n                # Get most of our data needed for the logic, and to reduce the number of time we need to talk to AD\r\n                $ADUser = (Get-ADUser -Identity $UserName -Properties SamAccountName -ErrorAction SilentlyContinue).SamAccountName\r\n                $ADGroup = Get-ADGroup -Identity $Group -ErrorAction SilentlyContinue\r\n                $ADInGroup = Get-ADGroupMember -Identity $Group -ErrorAction SilentlyContinue | Where-Object { $_.SamAccountName -like $ADUser }\r\n            }\r\n            catch {\r\n                Write-Error -Message \"Ninja Agent could not access AD, please check that the agent has permissions to add and remove users from groups.\"\r\n                exit 5 # Access Denied exit code\r\n            }\r\n            \r\n            # Modify AD User\r\n            if ($Action -like \"Remove\") {\r\n                # Verify that the user and group exist, and if the user is in the group\r\n                if (\r\n                    $ADUser -and\r\n                    # Check that the group exists\r\n                    $ADGroup -and\r\n                    # Check that the user exists in the group\r\n                    $ADInGroup\r\n                ) {\r\n                    Write-Output \"Found $UserName in Group $Group, removing.\"\r\n                    try {\r\n                        # Remove user from Group, -Confirm:$false used to not prompt and stop the script\r\n                        Remove-ADGroupMember -Identity $Group -Members $ADUser -Confirm:$false\r\n                        Write-Output \"Removed User $UserName from Group $Group\"\r\n                    }\r\n                    catch {\r\n                        Write-Error -Message \"Failed to remove User $UserName from Group $Group\"\r\n                        exit 529 # ERROR_MEMBER_NOT_IN_GROUP\r\n                    }\r\n                }\r\n                elseif (-not $ADGroup) {\r\n                    Write-Error -Message \"Group $Group does not exist\"\r\n                    exit 528 # ERROR_NO_SUCH_GROUP\r\n                }\r\n                elseif (-not $ADInGroup) {\r\n                    Write-Error -Message \"User does not exist in Group $Group\"\r\n                    exit 529 # ERROR_MEMBER_NOT_IN_GROUP\r\n                }\r\n            }\r\n            elseif ($Action -like \"Add\") {\r\n                # Verify that the user and group exist\r\n                if (\r\n                    # Check that the user exists\r\n                    $ADUser -and\r\n                    # Check that the group exists\r\n                    $ADGroup\r\n                ) {\r\n                    # Check if user is already in group\r\n                    if (-not $ADInGroup) {\r\n                        # User not in group, good to add\r\n                        try {\r\n                            # Add user to group\r\n                            Add-ADGroupMember -Identity $Group -Members $ADUser\r\n                            Write-Output \"Added User $UserName to Group $Group\"\r\n                        }\r\n                        catch {\r\n                            Write-Error -Message \"Failed to add User $UserName to Group $Group\"\r\n                            exit 1388 # ERROR_INVALID_MEMBER\r\n                        }\r\n                    }\r\n                    else {\r\n                        # User already in Group\r\n                        Write-Output \"User $UserName already in Group $Group\"\r\n                        exit 1320 # ERROR_MEMBER_IN_GROUP\r\n                    }\r\n                }\r\n            }\r\n        }\r\n        else {\r\n            # Throw error that RSAT: ActiveDirectory isn't installed\r\n            Write-Error -Message \"RSAT: ActiveDirectory is not installed or not found on this computer. The PowerShell Module called ActiveDirectory is needed to proceed.\" -RecommendedAction \"https:\/\/docs.microsoft.com\/en-us\/powershell\/module\/activedirectory\/?view=windowsserver2019-ps\"\r\n            exit 2 # File Not Found exit code\r\n        }\r\n    }\r\n}\r\n\r\nend {}<\/pre>\n
 <\/p>\n\n
Acc\u00e9dez \u00e0 plus de 700 scripts dans le Dojo NinjaOne<\/p>\n
Obtenez l’acc\u00e8s<\/a><\/p>\n<\/div>\n
Description d\u00e9taill\u00e9e<\/h2>\n
Le script commence par un message qui donne un aper\u00e7u de ses fonctionnalit\u00e9s, des exemples et des exigences. Des param\u00e8tres essentiels tels que Group, UserName, Action, et un commutateur facultatif IsDomainUser sont d\u00e9finis, qui contr\u00f4lent la logique principale. Une fonction d’aide, Test-IsElevated, v\u00e9rifie si le script s’ex\u00e9cute avec des droits d’administrateur. La logique principale commence par une v\u00e9rification de l’\u00e9l\u00e9vation, puis indique si la t\u00e2che concerne un utilisateur local ou un utilisateur Active Directory. En fonction de la version de PowerShell et de l’action souhait\u00e9e (ajouter ou supprimer des utilisateurs), le script s’interface avec Active Directory Service Interfaces (ADSI)<\/a> ou utilise des cmdlets PowerShell natifs.\u00a0Pour les utilisateurs Active Directory, le module Active Directory est utilis\u00e9, ce qui permet une int\u00e9gration et une gestion optimale.<\/p>\n
Cas d’utilisation potentiels<\/h2>\n
\u00c9tude de cas:<\/p>\n
Sarah, administratrice informatique dans une entreprise en pleine expansion, doit int\u00e9grer 50 nouveaux employ\u00e9s. Les d\u00e9partements et les r\u00f4les variant, l’attribution manuelle des utilisateurs aux groupes AD respectifs prendrait beaucoup de temps. Gr\u00e2ce \u00e0 ce script, Sarah affecte rapidement les utilisateurs \u00e0 leurs groupes respectifs, ce qui garantit que les contr\u00f4les d’acc\u00e8s sont respect\u00e9s. Lors des audits informatiques trimestriels, elle utilise \u00e9galement le script pour supprimer des utilisateurs de groupes sp\u00e9cifiques ou des machines locales des anciens employ\u00e9s.<\/p>\n
Comparaisons<\/h2>\n
La gestion traditionnelle des utilisateurs s’appuie g\u00e9n\u00e9ralement sur des outils \u00e0 interface graphique tels que Active Directory Users and Computers (ADUC) ou Computer Management pour les utilisateurs locaux. Bien qu’ils soient faciles \u00e0 utiliser, ils ne sont pas efficaces pour les op\u00e9rations \u00e0 grande \u00e9chelle. Ce script, qui s’appuie sur PowerShell, permet d’effectuer en quelques minutes des t\u00e2ches qui prendraient des heures. Cependant, contrairement aux outils d’interface graphique qui fournissent un retour d’information visuel, le script n\u00e9cessite des tests approfondis pour s’assurer qu’aucune action involontaire ne se produit.<\/p>\n
FAQ<\/h2>\n