ADGroup: Not removing members if MemberParameter is null

[voigtsv]

Hi,

in xActiveDirectory 2.18.0.0 when setting the member parameter of a xADGroup resource to null, existing groupmembers will not be removed. Instead the membership will be reported as "in the desired state".

xADGroup "Schema Admins"
        {
           GroupName = "Schema Admins"
           GroupScope = "Universal"
           Category = "Security"
           MembershipAttribute = "SamAccountName"
           Members = @()
           Description = "Designated administrators of the schema"
           Ensure = 'Present'
        }

This looks like the place where null values are skipped in the code
if ($PSBoundParameters.ContainsKey('Members') -and -not [system.string]::IsNullOrEmpty($Members))

Is there another way to do this?

Regards

[johlju]

Your scenario haven't been thought of. Normally having a group with empty members have no point, then the group could be removed instead. But that is not the case for the 'Schema Admins', since that group should not be removed.

Not sure of your scenario, I'm sure you have valid reasons for doing this (seeing your configuration). Although if you run this from a pull server then 'Schema Admins' will be empty every ~15 minutes (the default). It could potentially have consequences on any upgrade of the schema that is done in the future if it is removed in the middle of such upgrade.

If the resource should be able to empty a group from all members, then this is a bug. If instead the group should be removed if it should not contain any members, then this is by design.

@voigtsv What are your thoughts about this?

[voigtsv]

Having the group emptied every 15 minutes is exactly what I want. For Schema Admins and a couple of other groups that need to be there but empty in our default configuration.
In case of a schema update my plan is to pull a new configuration before and after.

@johlju I can see my case being a bit extraordinary though.

[johlju]

@voigtsv I label this as a bug and 'help wanted' so that someone in the community can run with this.