Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am struggling to find a decent way to do this. For one reason or another (not important, it is what it is) we have a rather a lot of users who are disabled but are still a member of all of their pre-disable groups. This is causing a few issues such as distribution list failures, difficulty enumerating ACL's etc.

Does anyone know of an easy way to bulk remove groups from users that are disabled? For ease, they all exist in one container now so if its something that can be done on container level, that's useful. Also, I know we could delete the accounts, but for auditing and cross linking with our HR system, that is not possible.

share|improve this question
Do you have any specific scripting requirement for this? e.g. Powershell, batch, VBS... – jscott Jun 8 '11 at 10:51
I'd like to see a Powershell example. – ewwhite Jun 8 '11 at 12:11
If you are worried about auditing you should NOT remove the users from groups. This typically invalidates audits – Jim B Jun 9 '11 at 0:17
up vote 3 down vote accepted

This sample batch file will do what you're asking. You'll need to edit the dsquery command to use your specific StartNode OU -- The OU=SomeOU,DC=example,DC=com bit:

REM Get list of disabled users in the domain
FOR /F "usebackq delims=;" %%A IN (`dsquery user "OU=SomeOU,DC=example,DC=com" -disabled -limit 0`) DO ( 
    echo User: %%A
    REM Enumerate user's group memberOf, exclude "Domain Users" group
    FOR /F "usebackq delims=;" %%B IN (`dsget user %%A -memberof ^| find /V "Domain Users"`) DO (
        ECHO Group: %%B
        REM Remove user %%A from Group %%B
        dsmod group %%B -rmmbr %%A
share|improve this answer
That looks decent. Gonna give that a try today and come back to confirm later. – Kip Jun 8 '11 at 11:38
@Kip If you want to test, replace dsmod group with ECHO dsmod group and you won't actually remove the users, you'll just echo the listing to the console. – jscott Jun 8 '11 at 11:41
Your script worked like a charm. I modified to include echo before I saw your comment to check it was doing what I want, and ran on a test ou with dummy users. Does the trick. Now running it on a wider scale. – Kip Jun 8 '11 at 13:05

Using Powershell and the Quest AD cmdlets available here, the following PowerShell script should do the trick -

$users =  Get-QADUser -Disabled
foreach ($user in $users)
    Remove-QADMemberOf -Identity $user -RemoveAll
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.