Archive for September 26th, 2007

Bulk group type & scope change

How do you bulk change group scope and type in PowerShell? This came up in the newsgroup today so I thought I would blog about the solution as well.

Suppose you want to change the scope of all Global Distribution groups in your domain to Universal. Getting the groups is easy – you just use Get-QADGroup with the appropriate parameters. However, AD cmdlets 1.0.4 still don’t have the Set-QADGroup cmdlet (which is coming soon ;)) so as usual we can cheat here by using Set-QADObject cmdlet and ObjectAttributes parameter which give access to any AD objects and attributes.

Because of this workaround we’ll need to supply the appropriate value for the new type and scope. This table will help you pick the one you need:

Value GroupType
2 Global distribution group
4 Domain local distribution group
8 Universal distribution group
-2147483646 Global security group
-2147483644 Domain local security group
-2147483640 Universal security group

So for example taking all global distribution groups and making them universal is a matter of running this one-liner:

Get-QADGroup -GroupType Distribution -GroupScope Global | Set-QADObject -ObjectAttributes @{grouptype=8}

A couple of notes:

  • By default, Get-QADGroup will only retrieve the first 1000 of groups matching the criteria. If you have more you might want to change the default size limit. Setting it to 0 will remove all limitations: -SizeLimit 0.
  • Not all groups can be converted to all types.

Tags: , , , , , , ,

My Recent Tweets


The posts on this blog are provided “as is” with no warranties and confer no rights. The opinions expressed on this site are mine and mine alone, and do not necessarily represent those of my employer - WSO2 or anyone else for that matter. All trademarks acknowledged.

© 2007-2014 Dmitry Sotnikov

September 2007

%d bloggers like this: