Copy User Group Memberships

This is an interactive task for copying group memberships from one User in Active Directory to another.

Playbook Files

This playbook was built for PPA version 3.3

plugins:
  active_directory: ^13.0
  hashicorp_vault: ^8.0
  ppa: ^11.4


set:
  search_base: null


steps:


  - name: Greeting
    actions:

      - ppa.ui.output_markdown:
          doc: >
            {{ globals.icons.active_directory.full }}


            #### Active Directory - Copy User Group Memberships


            Use this task to copy group memberships from one User in Active Directory to another.


            You will need to:


            - Search for & select _base_ & _target_ Active Directory Users

            - Pick the group memberships to copy from one to the other


      - ppa.ui.input_accept:
          text: Start


  - name: Get Secrets
    actions:

      - hashicorp_vault.key_value.read_secret_keys:
          secret: active_directory
          keys:
            - name: address
            - name: domain
            - name: username
            - name: password
              sensitive: true
          reason: Getting Active Directory details
          create_missing: true
        save: domain_controller


  - name: Get Base User
    while:
      name: valid_user
      value: false
    actions:

      - ppa.ui.output_markdown:
          doc: >
            ### Select Base User


            Please search for & select the _base_ user in Active Directory.


            This is the user whose group memberships will be copied to the _target_ user.

      - ppa.ui.input_accept:
          text: OK

      - active_directory.users.get_interactive:
          title: 1 - Base User Search
        load:
          domain_controller: domain_controller
        save: base_user

      - ppa.ui.output_progress:
          text: Getting group memberships for {{ base_user.sAMAccountName }}...
          percent: null
          element_id: get_group_memberships

      - active_directory.users.group_memberships:
        load:
          distinguishedName: base_user.distinguishedName
          domain_controller: domain_controller
        save: group_memberships

      - count:
        load:
          item: group_memberships
        save: group_count

      - ppa.ui.output_progress:
          text: Got group memberships for {{ base_user.sAMAccountName }}
          percent: 100
          element_id: get_group_memberships

      - ppa.ui.output_error:
          text: Base user {{ base_user.sAMAccountName }} is not in any groups, please select another user.
        when: group_count == 0

      - set:
          name: valid_user
          value: true
        when: group_count > 0


  - name: Get Target User
    actions:

      - ppa.ui.output_markdown:
          doc: >
            ### Select Target User


            Please search for & select the _target_ user in Active Directory.


            This is the user whose group memberships will be set.

      - ppa.ui.input_accept:
          text: OK

      - active_directory.users.get_interactive:
          title: 2 - Target User Search
        load:
          domain_controller: domain_controller
        save: target_user


  - name: Select & Confirm Groups
    while:
      name: groups_confirmed
      value: false
    actions:

      - active_directory.groups.display:
          text: Groups for base user {{ base_user.sAMAccountName }}
        load:
          groups: group_memberships

      - ppa.ui.input_confirm:
          text: Copy all group memberships?
        save: copy_all

      - set:
          name: groups
        load:
          value: group_memberships
        when: copy_all

      - active_directory.groups.select:
          text: Select group membership(s) to copy
          minimum: 1
        load:
          groups: group_memberships
        save: group_selection
        when: not copy_all

      - set:
          name: groups
        load:
          value: group_selection.all
        when: not copy_all

      - active_directory.groups.display:
          text: Groups to copy
        load:
          groups: groups
        when: not copy_all  # If they choose to copy all, the group table doesn't need displaying again.

      - ppa.ui.input_confirm:
          text: Add {{ target_user.sAMAccountName }} to {{ groups | length }} group(s)?
        save: groups_confirmed

      - ppa.ui.output_error:
          text: Please select the group(s) again.
        when: not groups_confirmed


  - name: Copy Group Memberships
    actions:

      - ppa.ui.output_progress:
          text: Adding {{ target_user.cn }} to {{ groups | length }} group(s)...
          percent: null
          element_id: copying

      - active_directory.groups.add_member:
        load:
          group_distinguishedName: group.distinguishedName
          member_distinguishedName: target_user.distinguishedName
          domain_controller: domain_controller
        for_each:
          items: groups
          name: group

      - ppa.ui.output_progress:
          text: Added {{ target_user.sAMAccountName }} to {{ groups | length }} group(s)
          percent: 100
          element_id: copying


  - name: Get Updated Group Memberships
    actions:

      - ppa.ui.output_progress:
          text: Getting group memberships for {{ target_user.cn }}...
          percent: null
          element_id: get_updated_groups

      - active_directory.users.group_memberships:
        load:
          distinguishedName: target_user.distinguishedName
          domain_controller: domain_controller
        save: updated_groups

      - ppa.ui.output_progress:
          text: Got group memberships for {{ target_user.cn }}
          percent: 100
          element_id: get_updated_groups

      - active_directory.groups.display:
          text: Group memberships for {{ target_user.cn }}
        load:
          groups: updated_groups


  - name: Summary
    actions:

      - ppa.ui.output_info:
          text: All operations completed successfully!

Running this Playbook

Click download playbook
Import the playbook on the Playbooks page in PPA
Build the playbook from the Edit & Build tab
Run the playbook from the Preview & Deploy tab

Integrations

PPA User Interface
Hashicorp Vault Key-Value engine
Active Directory Users & Groups

Required Vault Details

Active Directory

IP/DNS address of a Domain Controller
Domain FQDN
Username
Password

As this is a privileged task, the Active Directory credentials require the permission to set group memberships.

Vault Configuration Wizard

The first time you run a task built from this playbook, PPA will check the required Vault details exist.

If they don't exist, PPA will ask you to supply the details at the start of the task.

Below you can see a user providing details the first time they run an Active Directory task.

vault-config-wizard

Once the details are added to Vault, the task won't ask for them again.

If you don't know the required details, ask an administrator to run the task or configure Vault manually.

What the Task Does

Once started, this task allows the operator to:

Search for & select base & target Active Directory Users
Pick the group memberships to copy from one to the other

See our other playbooks

Get PPA for free!

Start automating your estate with a free 30 day trial today. No signup required!

Get PPA Express

Documentation

Installation Guide
See how easy it is to get started with our installation guide
Playbooks
View our task writing reference guide
Plugins
See how to integrate with different systems using our plugins reference guide.