CODEWITHSUNDEEP
powershell
DukeDonnovan
DukeDonnovan

Reputation: 140

How to add a well-known domain-group to a local group?

I am looking for a clean and simple solution (One-Liner?) to add the well-known domain-group Domain Users to a local group like "Direct Access Users".

I used the following code to add the "Authenticated Users" (= Well-known-SID S-1-5-11) to the local group:

Add-LocalGroupMember -Group "Direct Access Users" -Member S-1-5-11 -Verbose

This works fine, because the SID is static, but the SID for "Domain Users" looks like this S-1-5-21Domain-513 and I want to get the domain-SID dynamic too.

Thank you

Upvotes: 0

Views: 501

Answers (2)

Mathias R. Jessen
Mathias R. Jessen

Reputation: 174505

Grab the domain SID from the dNC root:

$RootDSE = [adsi]"LDAP://RootDSE"
$dNC = [adsi]"LDAP://$($RootDSE.defaultNamingContext)"
$domainSID = [System.Security.Principal.SecurityIdentifier]::new($dNC.Properties['objectSID'].Value, 0)
$domainUsers = [System.Security.Principal.SecurityIdentifier]::new('AccountDomainUsersSid', $domainSID)

Add-LocalGroupMember -Group "Direct Access Users" -Member $domainUsers.Value

Upvotes: 1

Jeroen Mostert
Jeroen Mostert

Reputation: 28789

I don't see any short way of doing this -- as in, something that will fit in one line "naturally" (you can always just smoosh it together if you really want to, of course). The difficult part seems to be getting the domain SID; once you have that, constructing the well-known SID of the Domain Users group is simple enough. The below uses the computer account to do that; the code could be abbreviated if you were allowed to assume a domain user is running this.

$qualifiedComputerName = [DirectoryServices.ActiveDirectory.Domain]::GetComputerDomain().Name + "\" + [Environment]::MachineName + "$"
$computerAccount = [Security.Principal.NTAccount]::new($qualifiedComputerName)
$domainSid = $computerAccount.Translate([Security.Principal.SecurityIdentifier]).AccountDomainSid
$domainUsersSid = [Security.Principal.SecurityIdentifier]::new("AccountDomainUsersSid", $domainSid).Value

Add-LocalGroupMember -Group "Direct Access Users" -Member $domainUsersSid -Verbose

Upvotes: 1

Related Questions