Skip to main content

How to Add a User to an Active Directory Group in Batch Script

Managing group memberships is a cornerstone of Active Directory administration, as it's the primary way to grant users access to resources like shared folders, applications, and printers. Automating this process (especially for onboarding new employees or changing roles) can save a huge amount of time. The standard, built-in command-line tool for modifying Active Directory objects is dsmod.exe.

This guide will teach you how to use the dsmod group command to add a user to an AD group from a batch script. You will learn the critical concept of Distinguished Names (DNs), how to find the DNs for users and groups, and the prerequisites required for the script to succeed.

CRITICAL: Prerequisites (RSAT Tools and Permissions)​

Before you can script this, three conditions must be met:

  1. RSAT for Active Directory Must Be Installed: The dsmod.exe command is not installed by default on Windows client operating systems. It is part of the Remote Server Administration Tools (RSAT).
    • On Windows 10/11, go to Settings -> Apps -> Optional features and install RSAT: Active Directory Domain Services and Lightweight Directory Services Tools.
  2. Permissions: The user running the script must have permission to modify the target group. This typically means being a Domain Admin, Account Operator, or having permissions delegated to you for that specific group or Organizational Unit (OU).
  3. Domain Environment: The script must be run on a domain-joined computer while logged in as a domain user.

The Core Command: dsmod group​

The dsmod (Directory Service Modify) command is used to modify the properties of an object in Active Directory. We use the group context to change a group's membership.

Syntax: dsmod group "<GroupDN>" -addmbr "<MemberDN>"

  • dsmod group: The command and object type.
  • <GroupDN>: The Distinguished Name of the group you are adding a member to.
  • -addmbr: The switch to add a member.
  • <MemberDN>: The Distinguished Name of the user (or group) you are adding.

Understanding Distinguished Names (DNs) and How to Find Them​

A Distinguished Name is the unique, full "address" of an object in the Active Directory tree. It is not just the username; it includes the object's location.

  • Example User DN: CN=John Doe,OU=Users,OU=NewYork,DC=mycorp,DC=local
  • Example Group DN: CN=Marketing Team,OU=Groups,DC=mycorp,DC=local
note

You can not guess a DN. You must find it using the dsquery and dsget commands.

How to Find a User's DN​

Use dsquery to find the user by their logon name (sAMAccountName) and pipe the result to dsget to retrieve their DN. dsquery user -samid "johndoe" | dsget user -dn

How to Find a Group's DN​

Use dsquery to find the group by its name and pipe the result to dsget to retrieve its DN. dsquery group -name "Marketing Team" | dsget group -dn

Basic Example: Adding a User to a Single Group​

This script demonstrates the full, robust process: find the DNs for the user and group, and then use dsmod to add the user to the group.

@ECHO OFF
SETLOCAL
SET "UserSamID=johndoe"
SET "GroupName=Marketing Team"

ECHO --- Adding '%UserSamID%' to group '%GroupName%' ---
ECHO.

ECHO Step 1: Finding the Distinguished Name for the user...
FOR /F "skip=1 delims=" %%D IN ('dsquery user -samid "%UserSamID%" ^| dsget user -dn') DO (
    SET "UserDN=%%D"
)
IF NOT DEFINED UserDN (ECHO [ERROR] User not found. & GOTO :End)
ECHO User DN: %UserDN%
ECHO.

ECHO Step 2: Finding the Distinguished Name for the group...
FOR /F "skip=1 delims=" %%D IN ('dsquery group -name "%GroupName%" ^| dsget group -dn') DO (
    SET "GroupDN=%%D"
)
IF NOT DEFINED GroupDN (ECHO [ERROR] Group not found. & GOTO :End)
ECHO Group DN: %GroupDN%
ECHO.

ECHO Step 3: Adding the user to the group...
dsmod group "%GroupDN%" -addmbr "%UserDN%"

IF %ERRORLEVEL% EQU 0 (
    ECHO [SUCCESS] User has been added to the group.
) ELSE (
    ECHO [FAILURE] The dsmod command failed. Check your permissions.
)

:End
ENDLOCAL

How the Command dsmod Works​

The dsmod command is a command-line interface for LDAP (Lightweight Directory Access Protocol). When you run dsmod group ... -addmbr ..., the command connects to a Domain Controller, authenticates as your user, and sends a formal LDAP "modify" request. This request tells the DC to add the user's Distinguished Name to the member attribute of the specified group object. This change is then replicated to other DCs.

Common Pitfalls and How to Solve Them​

Problem: 'dsmod' is not recognized...​

This means the RSAT tools are not installed.

Solution: Install the RSAT for Active Directory as described before.

Problem: "Access is denied." or "Insufficient access rights"​

This is a permissions issue.

Solution: Ensure the user account running the script has the necessary rights to modify the members of the target group.

Problem: "The object does not exist." (Wrong DN)​

This error from dsmod means one of the Distinguished Names you provided is incorrect.

Solution: Do not type DNs by hand. Always use dsquery and dsget to find the exact, correct DNs for your objects. Also, ensure you are enclosing the DNs in double quotes to handle any spaces or special characters in the names.

Practical Example: An Onboarding Script to Add a User to Multiple Groups​

This script is perfect for automating new user setup. It takes a new user's logon name and adds them to a standard list of groups.

@ECHO OFF
SETLOCAL
SET "NewUserSamID=%~1"
IF "%NewUserSamID%"=="" (ECHO Usage: %~n0 <sam_account_name> & GOTO :EOF)

REM --- Define a list of standard groups ---
SET "StandardGroups=Domain Users;VPN Access;Office365 Licensed"

ECHO --- Onboarding script for user: %NewUserSamID% ---
ECHO.

REM --- Get the User's DN once ---
FOR /F "skip=1 delims=" %%D IN ('dsquery user -samid "%NewUserSamID%" ^| dsget user -dn') DO SET "UserDN=%%D"
IF NOT DEFINED UserDN (ECHO [ERROR] User not found! & GOTO :EOF)

REM --- Loop through the list of groups ---
FOR %%G IN ("%StandardGroups:;=" "%") DO (
    SET "GroupName=%%~G"
    
    FOR /F "skip=1 delims=" %%D IN ('dsquery group -name "!GroupName!" ^| dsget group -dn') DO (
        SET "GroupDN=%%D"
    )
    
    IF DEFINED GroupDN (
        ECHO Adding user to group: !GroupName!
        dsmod group "!GroupDN!" -addmbr "%UserDN%"
    ) ELSE (
        ECHO [WARNING] Group "!GroupName!" not found.
    )
    ECHO.
)

ENDLOCAL

Conclusion​

The dsmod group command is the standard and most reliable way to add users to Active Directory groups from a batch script.

Key takeaways for success:

  • Install the RSAT for Active Directory to get the dsmod, dsquery, and dsget commands.
  • Ensure you are running the script with an account that has permission to modify the group.
  • The command requires the full Distinguished Name (DN) for both the group and the member.
  • Always use dsquery and dsget to find the correct DNs programmatically; do not try to guess them.

Table of Contents