Add group membership

Add a newly joined computer to Active Directory groups from a ConfigMgr Task Sequence. The self-contained Windows PowerShell 5.1 script checks direct membership, adds only when needed, and verifies the result on the same domain controller connection.

Current version: 1.0.1. The workflow publishes a prerelease candidate. Downloaded-asset verification and maintainer approval precede promotion to a regular release marked latest. Release status is not platform certification. Live ConfigMgr and Active Directory testing was not executed. This site follows main; the v1.0.1 release is a versioned snapshot with its own release notes.

Before deployment

Run as Local System in full Windows, after domain join and restart, inside an active ConfigMgr Task Sequence. WinPE, PowerShell 7, and ordinary interactive execution are not supported.

The default is Kerberos over LDAPS on TCP 636, with trusted domain controller certificates and a dedicated account delegated access only to the target groups. There is no automatic authentication or transport fallback.

Set the hidden custom variables ADGroupUserName and ADGroupPassword immediately before the packaged script step. Clear both on success and failure using native Task Sequence steps, and preserve the script’s result. Never put credentials in parameters or package content.

Documentation

Start here What it covers
Deployment Prerequisites, parameters, credential cleanup, exit codes
Compatibility Candidate platforms and explicit opt-in modes
Security Least privilege, credential limitations, private reporting
Validation Automated checks and the environment-validation checklist
Architecture Discovery, membership verification, bounded retries
Logging Dedicated CMTrace log, sanitized diagnostics, smsts.log
Troubleshooting Readiness, certificates, permissions, failure handling
Examples Generic Task Sequence pattern and contributor setup

Exit 0 means the computer is verified as a direct member of every requested group. Exit 1 means initialization or an operation failed. Successful additions are not rolled back when another group fails; verification does not prove replication to other domain controllers.

Source and releases

Browse source or read the script. Download release assets and their matching SHA-256 sidecars from GitHub Releases. Existing downloads do not update automatically.

For changes, see contributing and the release process. Maintained by Claudio Mendes (@vartaxe), under the MIT license.