Help creating a script to move users in and out of an OU based on a time limit

Question

Here's my scenario: we currently have OUs based on the locations of our facilities, we also have a sub-OU(?) underneath it for users that need a group policy applied to them where whitelist applications allowed to run. From time to time we have need to pull
users out of that sub-OU for a short period of time to let them run applications they normally wouldn't be able to and won't need to run long term. Sometimes we also forget to add these people back into that policy controlled sub-OU because we get busy do
other things. Server is 2008 R2.
Here's what I'm looking for: A script that prompts for the users name, pulls that user out of the sub-OU, puts them in the main OU but only for 24 hours. After that time limit is up, a script/command runs that puts the user back in the policy controlled
sub-OU. I'm thinking a PS script would be the best way to do this.
Research: Looking at these posts here and here I'm
thinking I should be able to Frankenstein something together but I have very limited PS scripting experience.
Can anyone help me create this?

Answer 1

You've probably figured this out, but we're not typically in the business of writing complete solutions for people. With that said, there are projects I find particularly interesting, such as this one, where I am willing to help get someone started if they
are willing to take the time to work through the examples and learn from them.
You have two requests - one is a script that prompts for a user it then moves to a different  location in Active Directory. The second request is a way to move them back without manual interaction. This will require an automated task (scheduled task)
that will run at select times during a day.
Here's the first script (1/2): The first two lines set two different variables. The first line sets the $OUPath variable to the SubOU. The second line prompts for a user and, once a user is entered, sets that user to the $User variable. It then runs the
first try-catch, attempting to replace the $User variable with the data returned from the Get-ADUser cmdlet. Notice the use of the -Properties parameter. By default the modified date and the extensionAttributes are not returned. We will be using the modified
date so we can be certain that 24 hours passes before we move them back (see part 2/2). Including extensionAttribute13 will ensure we only move users out of the OU if they were moved in by the script. Note: The modified date on a user in AD is changed when
it is moved from one OU to another. If the user cannot be located in the first try-catch it will say it cannot locate the user in Active Directory. If it can locate it, it will set the $User variable, as described so far, and then move on.
In the second (or, nested) try-catch we split the user's DistingusihedName at the first comma so that we have two parts. We use the second part (that doesn't include their CN) and see if that matches the $OUPath variable. If it does match then that user
has already been moved. If it doesn't match then we 1. Move the user, 2. Replace extensionAttribute13 with the string 'MovedUser,' and 3. Output that the user has been moved.
$OUPath = 'OU=SubOU,OU=MainOU,DC=mydomain,DC=com'
$User = Read-Host -Prompt 'Enter SamAccountName'
try {
$User = Get-ADUser -Identity $User -Properties Modified,extensionAttribute13
try {
If ($User.DistinguishedName.Split(',',2) -eq $OUPath) {
Write-Output -Verbose 'User already moved.'
} Else {
Move-ADObject -Identity $User.DistinguishedName -TargetPath $OUPath
Set-ADUser -Identity $User.SamAccountName -Replace @{extensionAttribute13='MovedUser'}
Write-Output "'$($User.SamAccountName)' has been moved."
catch {
Write-Output "'$($User.SamAccountName)' cannot be moved."
catch {
Write-Output -Verbose "Unable to locate '$User' in Active Directory."
The second script (2/2): Here we also set a couple variables - one is the SubOU's DistinguishedName where we want to return the user and the other is the all of the users from the MainOU. Foreach user in $Users we check if their extensionAttribute13 is set
to 'MovedUser' and if their modified date is greater than or equal (-ge) to 24 hours. If it is, the script will move the user, clear extensionAttribute13, and let us know the user was moved. If for some reason your $OUPath variable is wrong, the script will
run the catch portion of the only try-catch we used in this script. Again, you'll have to schedule Task Scheduler to run this script. Good luck!
$OUPath = 'OU=MainOU,DC=mydomain,DC=com'
$Users = Get-ADUser -Filter * -SearchBase $OUPath -Properties Modified,extensionAttribute13
Foreach ($User in $Users) {
$TimeSince = New-TimeSpan -Start $User.Modified -End (Get-Date)
If ($User.extensionAttribute13 -eq 'MovedUser' -and $TimeSince.Hours -ge 24) {
try {
Move-ADObject -Identity $User.DistinguishedName -TargetPath $OUPath
Set-ADUser -Identity $User.SamAccountName -Clear extensionAttribute13
Write-Output "$($User.SamAccountName) has been moved."
catch {
Write-Output "$($User.SamAccountName) cannot be moved."
} Else {
Write-Output 'No Users to move.'
If you decide to use this, be sure to change the paths you use for the $OUPath variables. Also, if you're using this with PowerShell 2.0, you will need to use the Import-Module cmdlet to import the ActiveDirectory module. In versions above 2.0 it will be
imported automatically if you try to use an AD cmdlet.
Edit: Typo - Get-ADUser property