So we are working on rolling out our software request portion of our catalog. We use Configuration Manager to manage the software packages. We use Active Directory Security groups to manage who all can install which software, and we have a self-service website where they can actually install the software once they are allowed access to that software title.
So, with all that out of the way, we needed to manage the users' ability to request the software, for a manager to approve it, and then for the user to be granted access. What better way than to use the Service Catalog! So, my awesome co-worker, Steve Hill Created the catalog section, where a user can go in and request the software.
So I worked on the orchestration piece, which is far from complete, but is functional so I wanted to post here on how to do it. So, basically after the RITM workflow gathers the appropriate approval, it would then call an Orchestration Run PowerShell activity to add the user to the group. Now, there is a little setup work to do that. You will need the sAMAccountName of the User (pretty much the user id from AD) and of the group. You will need to have Orchestration set up with AD credentials. You will need to have selected a default Mid-Server for orchestration activities. You will need to have set that mid-server's windows service to run as a user which has the ability to modify Active Directory.
Oh yeah, and one last thing, you need to turn on the active-directory PowerShell parts on your windows mid-server (has to be a windows mid-server). This is the part which I was missing, so I will show you how to do it:
First, go to Start -> Control Panel -> Programs and Features. On the left side, click 'Turn Windows features on or off" You will need to have administrator rights on your windows mid-server to do this. Next, the Server Manager box should pop up. On the left side, click on the 'Features' to expand it, then click, on the right-hand side, Add Features. Next, scroll down to "Remote Server Administration Tools" and expand it. Expand next the 'Role Administration Tools'. Lastly, expand the "AD DS and AD LDS Tools" Finally, you want to make sure to place a checkbox beside the "Active Directory module for Windows PowerShell" then click Install. This will enable your Run PowerShell activity to import the Active-Directory module.
So, now that your server is set up to be able to use ActiveDirectory module in PowerShell, we need to create the workflow item to actually do the lifting.
So, open your workflow, add in a Run Powershell activity. It should look similar to this:
Open the Run Powershell activity. Set the Hostname to the hostname of your mid-server (not to the domain controller). Then for the command, you will have the following:
Import-Module ActiveDirectory
Add-ADGroupMember -Identity "<enter your group name here>" -Members "<enter the user sAMAccountName here>"
Now, of course, this is hardcoded, you would of course want to pass the group and user as variables, but that's simple enough.
You can now test your script out, and you should see that the user (the second parameter) is added to the group (the first parameter).
I hope this helps you guys out. It's pretty simple with PowerShell v2. Before v2, it was quite a few lines of code to make this happen.
