Powershell Script to Exclude Members of AD Group when Creating Shadow Group

Hi,

I often have a need to create Shadow Groups for our organization, but I'm having trouble adding an extra filter in this instance.  The following script is the one I use to create a shadow group of all computers based in an OU plus sub-OU's, but this time I need to also exclude any computers that are members of an AD Security Group.

Import-Module ActiveDirectory
$OU="OU=Building One,OU=WSUS,DC=company,DC=local"
$ShadowGroup="CN=WSUS - Building 1,OU=WSUS,OU=Groups,OU=User Accounts,DC=company,DC=local"
Get-ADGroupMember –Identity $ShadowGroup | Where-Object {$_.distinguishedName –NotMatch $OU} | ForEach-Object {Remove-ADPrincipalGroupMembership –Identity $_ –MemberOf $ShadowGroup –Confirm:$false}
Get-ADComputer –SearchBase $OU –SearchScope subtree –LDAPFilter "(!memberOf=$ShadowGroup)" | ForEach-Object {Add-ADPrincipalGroupMembership –Identity $_ –MemberOf $ShadowGroup}

So I now need to add the following filter - if the computer is a member of the "WSUS Deny Group Policy" AD security group, I want them to be excluded from the Shadow Group.

I have tried a couple of filters, such as:

Adding this after line 3: $group1 = Get-ADGroup "WSUS Deny Group Policy"

Get-ADGroupMember –Identity $ShadowGroup | Where-Object {$_.distinguishedName –NotMatch $OU} -or {$_.distinguishedName –NotMatch $group1} | ForEach-Object {Remove-ADPrincipalGroupMembership –Identity $_ –MemberOf $ShadowGroup –Confirm:$false}

but my arguments are incorrect.  I have also tried this:

Get-ADComputer -Filter {MemberOf -notlike $group1} –SearchBase $OU –SearchScope subtree –LDAPFilter "(!memberOf=$ShadowGroup)" | ForEach-Object {Add-ADPrincipalGroupMembership –Identity $_ –MemberOf $ShadowGroup}

Can anyone help point me in the right direction please?

Many thanks