member name

(is | is not) literal name
(like | not like) wildcard expression
(matches | not matches) regular expression

Purpose

Warns when the specified AD group's member account name do not match the specification.

Notes

This requirement may be repeated in the same section.

For is and is not operators, one matching group member will satisfy the requirement:

# If any immediate group member's canonical name is 'example', Martinet will not generate a warning.
member name is example

# If the immediate group members don't include the account with canonical name 'example', Martinet will not generate a warning.
member name is not example

Where this requirement might be used

AD groups which must/must not contain one or more group members. This requirement references group members by canonical name, so if a required/excluded group member's canonical name changes, this requirement will need to be edited to keep up with the name change.

Example configuration

# Warn if there is no immediate group member named 'MyUnit All Users'.
[group:"Field Consultants" "CN=Field Services OU Admins,OU=FC Groups,OU=Field Consulting,OU=Delegated,OU=TechServices,OU=Urbana,DC=ad,DC=uillinois,DC=edu" "CN=Tech Services FC Tech\*,OU=FC Groups,OU=Field Consulting,OU=Delegated,OU=TechServices,OU=Urbana,DC=ad,DC=uillinois,DC=edu" "03efc439-b0dc-4615-afed-646fd22dfe34"]
member name is MyUnit All Users

Example output

Line 6: Found 4 AD groups with no immediate member whose canonical name is “MyUnit All Users”:

ObjectGUID	Name	sAMAccountName
2515e8a0-1f1c-41f4-9139-eebc07ab2dc1	Field Consultants	Field Consultants
d962fe33-6501-45fd-a686-962f49481e7b	Field Services OU Admins	Field Services OU Admins
f79cefc3-ac3c-4993-aab7-759d661ccfeb	Tech Services FC TechOps	FCTechOps
03efc439-b0dc-4615-afed-646fd22dfe34	FC-Unix	FC-Unix

Example configuration

# Kenn Wislander (wislande) should not be listed in any of these groups. Warn if he's listed.
[group:"Field Consultants" "CN=Field Services OU Admins,OU=FC Groups,OU=Field Consulting,OU=Delegated,OU=TechServices,OU=Urbana,DC=ad,DC=uillinois,DC=edu" "CN=Tech Services FC Tech\*,OU=FC Groups,OU=Field Consulting,OU=Delegated,OU=TechServices,OU=Urbana,DC=ad,DC=uillinois,DC=edu" "03efc439-b0dc-4615-afed-646fd22dfe34"]
member name is not wislande

Example output

Line 6: Found 3 AD groups with an immediate member whose canonical name is “wislande”:

ObjectGUID	Name	sAMAccountName
2515e8a0-1f1c-41f4-9139-eebc07ab2dc1	Field Consultants	Field Consultants
d962fe33-6501-45fd-a686-962f49481e7b	Field Services OU Admins	Field Services OU Admins
f79cefc3-ac3c-4993-aab7-759d661ccfeb	Tech Services FC TechOps	FCTechOps

Example configuration

# Members of these groups should not have vowels in their canonical names. Warn if member's canonical names have vowels.
[group:"Field Consultants" "CN=Field Services OU Admins,OU=FC Groups,OU=Field Consulting,OU=Delegated,OU=TechServices,OU=Urbana,DC=ad,DC=uillinois,DC=edu" "CN=Tech Services FC Tech\*,OU=FC Groups,OU=Field Consulting,OU=Delegated,OU=TechServices,OU=Urbana,DC=ad,DC=uillinois,DC=edu" "03efc439-b0dc-4615-afed-646fd22dfe34"]
member name not like *[aeiou]*

Example output

Line 6: Found 4 AD groups with an immediate member whose canonical name matches wildcard expression “*[aeiou]*”:

ObjectGUID	sAMAccountName	Name	Relevant Group Members
2515e8a0-1f1c-41f4-9139-eebc07ab2dc1	Field Consultants	Field Consultants	wislande; ediii; kpointer; lee400; elarson; jabrwn; gulley1; dking13; andrewr; kmark80
d962fe33-6501-45fd-a686-962f49481e7b	Field Services OU Admins	Field Services OU Admins	CITES-FC-Sandbox-Admins; wislande
f79cefc3-ac3c-4993-aab7-759d661ccfeb	FCTechOps	Tech Services FC TechOps	jabrwn; lee400; kpointer; wislande
03efc439-b0dc-4615-afed-646fd22dfe34	FC-Unix	FC-Unix	andrewr; kpointer