thank you and correct! i found this bug myself and revisited this to update.

Couldn’t get the (Get-ADGroup -Identity $ShadowGroup).Members to work,
but this worked for me.
(Get-ADGroup -Identity $ShadowGroup -Properties Member).Member | Get-ADUser | …

I realize this is 3 years old but I had this same issue. For some reason when we copy+paste, some dashes “-” end up as a weird character combination: – . I can even see it in the code you pasted up above. I used the Powershell ISE to find and replace the characters. For some reason, they look fine in Notepad++

(Get-ADGroup -Identity $ShadowGroup).Members | Get-ADUser | Where-Object {$_.distinguishedName –NotMatch $OU} | …

thanks again, best solution thus far. i’ve expanded a bit and added email support: https://gist.github.com/meoso/301f2e94306dcf2d3714c26ca5518932

http://stackoverflow.com/questions/1215260/how-to-redirect-the-output-of-a-powershell-to-a-file-during-its-execution

Thanks for the tips!

Sorry to hear about your AD issues. The script only acts on one security group at a time. It will remove users from that one group if they are not in the OU specified. And it will add users to that one group if they are in the OU specified. It would NOT remove users from any other group. Good luck!

I made a big mess with our AD.

I’m a noob with scripting, and I dont know any script junky to ask for help.

I’m not sure if the script above was actually intended to do this, but for some reason, I’ve ran the script, and then security groups were all removed from their previous users, and only added to the particular group. Is that what it was supposed to do?

Our AD is a mess, and I’m slowly but surely trying to redo it properly.

Also, if this is the intention of the script, would you please be so kind as to send me the script that only adds the security groups to the OU, and not remove them from the other users account in other groups.

Regards
Armand