-1

I have an AD container of disabled users that I need to remove all their group memberships. Although I know how to remove the memberships on an individual basis by Read-Host the username, I'm not sure how to do it for all users of the specific container.

I was thinking that the best way to do this would be to use a ForEach-Object to look the command through all the users, but I'm not sure how to make this action for the specific container. The last thing I want to do is to remove group memberships for all my active users.

1

3 Answers 3

1

If I understand your question correctly this should do it. I put the -confirm on here so you don't accidentally blow away group members you didn't intent to.

$users=Get-ADUser -SearchBase "OU=Test,DC=domain,DC=com" -Filter *
$groups=Get-ADGroup -Filter *


foreach($group in $groups){
    $check=Get-ADGroupMember -Identity $group.Name
        foreach($user in $users){
            if ($check.name -contains $user.name){
                Remove-ADGroupMember -Identity $group.Name -Members $user.SamAccountName -Confirm
            }
        }
} 
1

In addition to specifying a SearchBase in my get-aduser filter, I have an LDAP filter that finds only disabled accounts (we programmatically disable accounts, so there is a single userAccountControl value for all disabled accounts) as I've occasionally seen admins (wrongly) stash an active user in our dedicated disabled user OU.

The filter also limits the results to disabled users that are members of some group to avoid re-processing people on each batch cycle. This allows me to have another safety -- the batch only removes group memberships if a "reasonable" number of newly disabled accounts are found & sends me an e-mail alert if too many users are returned in the search. What is "reasonable" depends on how many people get disabled between batch runs. When we do a big layoff, I've got to go in and manually up the number to clean up a couple hundred accounts ... but it's saved us when striking workers got disabled (they were not meant to be logging in, but no one wanted to wipe all the group memberships).

Once you've got the disabled users, iterate through their memberOf values to remove the groups.

$objDisabledUsers=Get-ADUser -SearchBase "OU=DisabledUsers,DC=example,DC=com" -LDAPFilter "(&(userAccountControl=514)(memberOf=*)(objectCategory=person))" -Properties name, sAMAccountName, memberOf

if($objDisabledUsers.Count -lt 10){
    foreach($objUser in $objDisabledUsers){
        $objGroupMemberships = $objUser.memberOf
        foreach($strGroup in $objGroupMemberships){
            write-host "Removing $objUser from $strGroup"
            Remove-ADGroupMember -Identity $strGroup -Members $objUser.SamAccountName -Confirm:$false
        }
    }
}
0

So I attempted to use your script example, but I'm running into problems getting things to work and I'm not understanding where I'm messing things up or misunderstanding the error. I've researched on the error and tried to make sense of the "-Identity" parameter, but something is eluding me.

# Variables
$User1=Get-ADUser -SearchBase 'OU=Employees DISABLED,DC=domain,DC=com' -Filter *
$groups=Get-ADGroup "Disabled Users"

foreach($group in $groups){
    $check=Get-ADGroupMember -Identity $group.Name
        foreach($user in $User1){
            if ($check.name -contains $user.name){
                # Disables named users ActiveDirectory Account.
                 Disable-ADAccount -Identity $User1

                # Adds AD group "Disabled Users" to named user group membership
                Add-ADGroupMember -Identity 'Disabled Users' -Member $User1
            }
        }
} 

However, this is the error message I'm getting:

Disable-ADAccount : Cannot convert 'System.Object[]' to the type 'Microsoft.ActiveDirectory.Management.ADAccount' required by parameter 'Identity'. Specified method is not supported. At C:\Users\david.gage\Documents\Powershell\Scripts\TEST - Disabled User Cleanup.ps1:10 char:46 + Disable-ADAccount -Identity $User1 + ~~~~~~ + CategoryInfo : InvalidArgument: (:) [Disable-ADAccount], ParameterBindingException + FullyQualifiedErrorId : CannotConvertArgument,Microsoft.ActiveDirectory.Management.Commands.DisableADAccount

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.