Importing AD Groups into Identum eADM

PowerShell

<# 
Description: Exports AD groups to CSV for eADM import.
Usage: Update variables in the "Setup" section before running.
#>

#------ General Setup ------
$customer = "utfjord"          # Short customer name, used in file extensions.
$eadm_path = "C:\eadm"         # Path to eAdm installation.
$outputfolder = "C:\eadm\tmp\groupexport"  # Output directory. Folder must exist.
$exportmembers = "false"       # Set to "false" for initial group import.

# ------ System Values ------
$domaincontroller = "DC01"     # Name of the DC used for extraction.
$domain = "domain.local"
$mergeAttribute = "employeeNumber"  # Unique user attribute (e.g., samaccountName or employeeNumber).
$sourceId = "objectGuid"       # Source ID type (objectGuid or samaccountName).

#------ Groups / OUs ------
# Define OUs to export. Add specific OUs to the array below.

$groupOUs = @()

# Add an object for each OU
$groupOUs += @{
    DN    = "OU=Grupper,OU=Resurser,DC=utfjord,DC=local" # Full DN of the OU.
    alias = "Felles"           # Short name for the OU (used in filenames).
    scope = "SubTree"          # Search scope: "SubTree" or "OneLevel".
    synctemplateid = "ImportedGroups"  # ID of the sync template.
}

#------ Members ------
$userSearchBase = "OU=Brukere,DC=utfjord,DC=local" # Parent OU for member fetch.

<# 
Limit user selection to specific OUs if necessary. 
Set equal to $userSearchbase if no limitations are needed. 
#>
$userOUs = @(
    "OU=Brukere,DC=utfjord,DC=local"
) 

# // End of Setup

#------ Export Logic ------

# Create Regex for User OU validation
$regex = ""
$userOUs | ForEach-Object { $regex += ".*," + [Regex]::Escape($_) + "$|" }
$regex = $regex.Substring(0,$regex.Length-1)

foreach ($ou in $groupOUs) {

    Write-Host "Fetching groups for OU $($ou.DN)"    
    $groups = Get-ADGroup -filter '*' -searchbase "$($ou.DN)" -searchscope "$($ou.scope)" -properties name,samaccountname,description,ManagedBy,mailnickname,grouptype,groupscope,GroupCategory,Mail,distinguishedName,ObjectGuid 

    Write-Host "Writing group list to file for OU $($ou.DN) --> $($outputfolder)"    
    
    $groups | Select-Object @{Label="name";Expression = {("$($_.samaccountname)")}},`
                            @{Label="displayname";Expression = {("$($_.name)")}},`
                            @{Label="sourceid";Expression = {("$($_.$($sourceid))")}},`
                            mail,description,`
                            @{Label="GroupType";Expression = {("$($_.groupScope)$($_.GroupCategory)")}},`
                            @{n='parentPath';e={$_.DistinguishedName -replace '^.*?,(?=[A-Z]{2}=)'}},`
                            @{Label="groupScope";Expression = {("OnPremAD")}},`
                            @{Label="ImportedAnchor";Expression = {($_.objectguid)}},`
                            @{Label="parent";Expression = {($ou.synctemplateid)}} | 
                            ConvertTo-Csv -NoTypeInformation -Delimiter ";" | 
                            ForEach-Object { $_ -replace '"' } | 
                            Out-file -Encoding utf8 -filepath "$($outputfolder)\groups-$($ou.alias).csv"

    # Member export logic (Skipped if $exportmembers is false)
    if($exportmembers -eq "true") {    
        foreach ($group in $groups) {
            Write-Host "Fetching and writing members to file for group $($group.samaccountname) --> $($outputfolder)" 
            (Get-ADGroupMember -identity $group.samaccountname -Recursive | 
            Where-Object {$_.objectClass -eq "user"} | 
            Get-ADUser -Properties $($mergeattribute) | 
            Where-Object { $_.DistinguishedName -match $regex -and $_.enabled -eq $True -and $($mergeattribute) -like "*"} | 
            ForEach-Object { $_.$($mergeattribute) }) -join "," | 
            Out-file -filepath "$($outputfolder)\members-$($group.samaccountname)_$($customer).csv" -Encoding UTF8
        }
    }
}