From fe059de50d39f1093f0f2ac84a63e15063e450c3 Mon Sep 17 00:00:00 2001
From: Meik <meik.drechsler@consulting4it.de>
Date: Thu, 18 Jun 2026 16:30:32 +0200
Subject: [PATCH] Use LDAP lookup for fixture groups

---
 Sonstiges/New-LiamNtfsDemoShareStructure.ps1 | 49 ++++++++++++++++++--
 1 file changed, 45 insertions(+), 4 deletions(-)

diff --git a/Sonstiges/New-LiamNtfsDemoShareStructure.ps1 b/Sonstiges/New-LiamNtfsDemoShareStructure.ps1
index d4af9b9..1c3504b 100644
--- a/Sonstiges/New-LiamNtfsDemoShareStructure.ps1
+++ b/Sonstiges/New-LiamNtfsDemoShareStructure.ps1
@@ -369,6 +369,47 @@ function Ensure-SmbShare {
     }
 }
 
+function ConvertTo-LdapFilterEscapedValue {
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Value
+    )
+
+    $escapedValue = $Value.Replace('\', '\5c')
+    $escapedValue = $escapedValue.Replace('*', '\2a')
+    $escapedValue = $escapedValue.Replace('(', '\28')
+    $escapedValue = $escapedValue.Replace(')', '\29')
+    $escapedValue = $escapedValue.Replace([string][char]0, '\00')
+
+    return $escapedValue
+}
+
+function Get-AdGroupBySamAccountName {
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$SamAccountName,
+
+        [string[]]$Properties = @()
+    )
+
+    $escapedSamAccountName = ConvertTo-LdapFilterEscapedValue -Value $SamAccountName
+    $parameters = @{
+        LDAPFilter  = "(sAMAccountName=$escapedSamAccountName)"
+        ErrorAction = 'Stop'
+    }
+
+    if ($Properties.Count -gt 0) {
+        $parameters['Properties'] = $Properties
+    }
+
+    try {
+        return Get-ADGroup @parameters | Select-Object -First 1
+    }
+    catch [Microsoft.ActiveDirectory.Management.ADIdentityNotFoundException] {
+        return $null
+    }
+}
+
 function Ensure-AdGroup {
     param(
         [Parameter(Mandatory = $true)]
@@ -382,7 +423,7 @@ function Ensure-AdGroup {
         [string]$Description
     )
 
-    $existingGroup = Get-ADGroup -Identity $Name -ErrorAction SilentlyContinue
+    $existingGroup = Get-AdGroupBySamAccountName -SamAccountName $Name
     if ($existingGroup) {
         return $existingGroup
     }
@@ -397,7 +438,7 @@ function Ensure-AdGroup {
             -Description $Description | Out-Null
     }
 
-    return Get-ADGroup -Identity $Name -ErrorAction SilentlyContinue
+    return Get-AdGroupBySamAccountName -SamAccountName $Name
 }
 
 function Ensure-AdGroupMembership {
@@ -409,8 +450,8 @@ function Ensure-AdGroupMembership {
         [string]$MemberGroup
     )
 
-    $parent = Get-ADGroup -Identity $ParentGroup -Properties member -ErrorAction SilentlyContinue
-    $member = Get-ADGroup -Identity $MemberGroup -ErrorAction SilentlyContinue
+    $parent = Get-AdGroupBySamAccountName -SamAccountName $ParentGroup -Properties @('member')
+    $member = Get-AdGroupBySamAccountName -SamAccountName $MemberGroup
     if (-not $parent -or -not $member) {
         if ($WhatIfPreference) {
             if ($PSCmdlet.ShouldProcess($ParentGroup, "Add member group '$MemberGroup'")) {