Home / server / Questions / 632796
In Process
Timmmm
Asked: 2014-10-02 07:22:22 +0800 CST

Is there an easy way to add yourself to an Active Directory group, with only Add/Remove Self permission?

  • 772

At my work where there is an Active Directory / Exchange / Outlook setup (sorry I'm not a Microsoft pro), I'm trying to set up a distribution list to act like a mailing list. That means users should only be able to add/remove themselves, and additionally I want it so that only users in a certain security group can add themselves.

I have sort-of acheived this, by giving the appropriate group the permission "Add/remove self as member" for the distribution list.

Permissions

Having done that, users can then add themselves to the group by opening ADUC (Active Directory Users and Groups), and then either:

  1. Right click their user account, select Add to Group, and then type in the appropriate distribution list in the resulting dialog.

Add to group

  1. Or double click their name to go to Properties, then the "Member of" tab, then click Add and type the distribution list as before.

The only way to remove themselves from the group is then to remove it from the "Member of" tab.

Member of

The problem

The problem is that most users do not have ADUC installed. If they try to add themselves to the group in the normal way through the Outlook address book, they are greeted with the following permission error, even if they only add themselves.

Erroar!

Is there any way for users to add themselves to the distribution list without using ADUC and without getting the above error message?

active-directory

1 Answers

  1. If you're not afraid of the command line, this works with the permissions you describe:

    import-module activedirectory
get-adgroup TestGroup456 | add-adgroupmember -members TestUser123

    Its very basic. You could dress it up different ways in a script. I used the unique samAccountNames here... If your user base is not familiar with SAM names, you could add some search logic to obtain the full distinguished names. If you are seeking a GUI friendly solution, this may not be what you are looking for...

    • 1