Verify GroupMembership with Pester

‘Sup PSHomies,

Here’s another advantage of adding members with a different approach, Pester validation!

This makes for an easy way to process validation of  each member of a group.

Quick update: I’ve added  some extra code (at the end of the previous blog code) to export added- and revoked members.

#region Export for futher processing
$GroupMembers =@{
  Groups  = $Header
  Added   = $addADGroupMembers
  Revoked = $delADGroupMembers
}
$GroupMembers |
Export-Clixml .\export\dsa\ADGroupMembers-$exportDate.xml -Encoding UTF8
#endregion

Quick rundown, first we’ll import the saved object and used that to get a snapshot of the current group members. Then it’s time to vaildate who has been added or revoked.

	<#
	Author: I. Strachan
	Version:
	Version History:
	Purpose: Validate group membership being added or revoked
	#>
	[CmdletBinding()]
	param(
	$xmlFile = 'ADGroupMembers-12102016.xml'
	)
	#Get saved group members from xmlFile
	$SavedGroupMembers = Import-Clixml .\export\dsa\$xmlFile
	#region Get current Group memberships
	$SnapshotADGroupMembers = @{}
	$SavedGroupMembers.Groups |
	ForEach-Object{
	$SnapshotADGroupMembers.$($_.SamAccountName) = Get-ADGroupMember -Identity $_.SamAccountName| Select-Object -ExpandProperty SamAccountName
	}
	#endregion
	#region Verify members being revoked.
	$SavedGroupMembers.Revoked.Keys |
	ForEach-Object{
	$GroupName = $_
	if($SnapshotADGroupMembers.$GroupName){
	Describe "AD GroupMembership revoked operational readiness for $GroupName" -Tags Revoked{
	Context "Verifying users whose membership has been revoked from $GroupName."{
	$SavedGroupMembers.Revoked.$GroupName |
	ForEach-Object{
	It "User $($_) is not a member of $($GroupName)"{
	!($SnapshotADGroupMembers.$GroupName.Contains($_)) | Should be $true
	}
	}
	}
	}
	}
	}
	#endregion
	#region Verify members being added.
	$SavedGroupMembers.Added.Keys |
	ForEach-Object{
	$GroupName = $_
	if($SnapshotADGroupMembers.$GroupName){
	Describe "AD GroupMembership added operational readiness for $GroupName" -Tags Added{
	Context "Verifying users who are members of $GroupName."{
	$SavedGroupMembers.Added.$GroupName |
	ForEach-Object{
	It "User $($_) is a member of $($GroupName)"{
	($SnapshotADGroupMembers.$GroupName.Contains($_)) | Should be $true
	}
	}
	}
	}
	}
	}
	#endregion
	#region Save Current membership for future reference
	$SnapshotADGroupMembers |
	Export-Clixml .\export\dsa\SnapshotADGroupMembers-$exportDate.xml -Encoding UTF8
	#endregion

view raw ADGroupMembers.Tests.ps1 hosted with ❤ by GitHub

In this case I wanted to generate different Describe blocks. This makes for a better distribution in the HTML report.

Here’s the code to generate the HTML report using reportunit.exe

#region
$exportDate = Get-Date -Format ddMMyyyy
#endregion

#region Main
$pesterGroupMembers = Invoke-Pester .\ps1\dsa\ADGroupMembers*  -OutputFile .\export\dsa\ADGroupMembers.NUnit.xml -OutputFormat NUnitXml -PassThru

#run reportunit against ADgroupMembers.NUnit.xml and display result in browser
& .\tools\ReportUnit\reportunit.exe .\export\dsa\ADGroupMembers.NUnit.xml
Invoke-Item .\export\dsa\ADGroupMembers.NUnit.html

#Export Pester results to xml
$pesterGroupMembers | Export-Clixml .\export\dsa\PesterResults-GroupMembers-$($exportDate).xml -Encoding UTF8
#endregion

Making sure a user is a member can be tricky at times especially when the members list is a few hundred.

As always, snapshots are your friend! When I exported the groups the first time I did it without validating if they existed. I recently ran into a situation where AD Objects were being deleted and recreated using the same SamAccountName! So having a little more information than just the SamAccountName can help when troubleshooting now and in the future.

When my project manager asked for logs and I handed him the HTML generated report of the group members… You should have seen the glee on his face!

So there you have it, verfying group membership using Pester!

Hope it’s worth something to you…

Ttyl,

Urv

Advertisement