diff --git a/Update-StaffAD.ps1 b/Update-StaffAD.ps1 index 67f3bc5..72e5010 100644 --- a/Update-StaffAD.ps1 +++ b/Update-StaffAD.ps1 @@ -186,10 +186,16 @@ foreach ($entry in $Deduped.Values) { if ($DryRun) { $disables++ } } - # Move user to correct OU + # Move user to correct OU (skip Domain Admins) if ($willMove) { - if ($DryRun) { + $isDomainAdmin = (Get-ADUser $samAccount -Properties MemberOf).MemberOf | + Where-Object { $_ -match "^CN=Domain Admins," } + + if ($isDomainAdmin) { + Write-Log " OU Move : SKIPPED - user is a Domain Admin" "Yellow" + } elseif ($DryRun) { Write-Log " OU Move : WOULD MOVE to $targetOU" "Magenta" + $moved++ } else { try { Move-ADObject -Identity $adUser.DistinguishedName -TargetPath $targetOU @@ -199,7 +205,6 @@ foreach ($entry in $Deduped.Values) { Write-Log " OU Move : FAILED to move - $_" "Red" } } - if ($DryRun) { $moved++ } } }