Photo by Aron Visuals / Unsplash
Add an object temporarily to an AD group

Add an object temporarily to an AD group

Published on 26 Sep 2023

Bastien Perez
Bastien Perez


When using Active Directory, it may be necessary to temporarily add a user to a group. This is made possible by the Privileged Access Management feature.

This article presents the different ways of adding a user to a group for a period of one hour.

Although the article focuses on one user, it is possible to add any type of object on a temporary basis.

With Add-ADGroupMember

Add-ADGroupMember -Identity "MyGroup1" -Members "Bastien" -MemberTimeToLive (New-TimeSpan -Hours 1)

With Set-ADObject

The member must be <TTL=xxxx,DNObject>.

Set-ADObject -Identity "CN=MyGroup,<resteduDN>" -Add @{'member'="<TTL=3600,CN=bastien,<resteDuDn>"}


The member must be<TTL=xxxx,DNObject>. However, if you use LDIF, you must also encode to base 64.

You can use PowerShell to convert to base 64 :

$text = "<TTL=xxx,CN=xx,OU=Users,DC=domain,DC=com>"

The LDIF file should look like this :

changetype: modify
add: member
member:: base64value

Note : member is preceded by two ':' because it is the base 64 standard (see


banner-Bastien Perez
Bastien Perez

Freelance Microsoft 365 - Active Directory - Modern Workplace