Delete a windows group in Active Directory

Question

I am doing a cleanup of some AD groups that are no longer used. One of the AD groups I could not delete because it seems that a member has this group set as the primary group (which I assume someone did by accident). Is there an easy way to find out who has this group set as primary?

Answer 1

You'll need to get the primaryGroupToken value of the group in question:

1. Use adsiedit to examine the group you want to get delete. Make note of the primaryGroupToken attribute's value.

2. Create a Saved Query in Active Directory Users and Computers using the following "Custom Search" where XXX= the value you found for primaryGroupToken:

   (&(objectCategory=person)(objectClass=user)(primaryGroupID=XXX))

3. Refresh the query to see who shows up

Alternatively - If all users are expected to be members of Domain Users as their primary group, just define the query using(513 is the typical value for Domain Users):

(&(objectCategory=person)(objectClass=user)(!primaryGroupID=513))

Additional Links:

http://support.microsoft.com/default.aspx?scid=kb;en-us;321360 http://support.microsoft.com/default.aspx?scid=kb;en-us;297951

Great Question!

Answer 2

I know this is a old thread but for people having this same issue. If you are removing the group anyways there is a easier method.

• Open the group and go to the members tab.
• Select all the users
• Remove the users.
• One of the users that are left has the group as the primary. For me it was the user with the lowest alphabetical name.
• Change the primary group for that user
• Delete group or repeat to find other users with this group as the primary.