Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm looking for a way to remove ALL users from a list of Active Directory groups.

For example I have a txt file with a bunch of group names, and I'd like to go through all of them and remove all the users inside of them.

A way to do it without using a text file would work as well, but I have a very large amount of groups that need to have this done, and might need to in the future as well ( possibly periodically ).

This is what I'm working with now :

Set objGroup = GetObject("LDAP://CN=Finance Users,OU=Finance,DC=fabrikam,DC=com") 

For Each strUser in objGroup.Member 
    objGroup.PutEx ADS_PROPERTY_DELETE, "member", Array(strUser) 
    objGroup.SetInfo 
End 

Thanks!

share|improve this question

3 Answers 3

Powershell. Put all your groups into ingroups.txt, one per line. Save script as .ps1 file, and then execute.

function removeAllUsersFromGroup{
    Param([String]$GroupName)
    BEGIN   { Import-Module ActiveDirectory; if ($GroupName -eq ""){ throw "No group name specified" } Write-Host "Removing users from $GroupName" -f green }
    PROCESS { 
        $groupSID = (Get-ADGroup "Test Group").SID
        $groupMembers = Get-ADGroupMember -Identity $groupSID

        foreach ($member in $groupMembers){
            Remove-ADGroupMember -Identity $groupSID -Member $member.SID
        }
    }
    END     {  }
}

Get-Content .\ingroups.txt | %{ removeAllUsersFromGroup-groupname $_}

You must have the Windows RSAT installed, as it uses the Active Directory cmdlets. If a group does not exist, or is empty, you will get some powershell errors.

share|improve this answer
    
+1 Brushing up on your PS, I see. :D –  MDMarra Mar 6 '12 at 15:46
    
@MDMarra - yep. Been hammering it at work these past few weeks, figured I should share. –  Mark Henderson Mar 6 '12 at 19:20
Const ADS_PROPERTY_CLEAR = 1 

Set objGroup = GetObject("LDAP://cn=Finance Users,ou=Finance,dc=fabrikam,dc=com") 

objGroup.PutEx ADS_PROPERTY_CLEAR, "member", 0
objGroup.SetInfo

I use that to remove the users from a certain group.

I think a good solution for you would be to remove the members of ALL groups in a Certain OU, that would be much cleaner.

EDIT :

I actually found something that might work better, might want to run it in a test environment first, so you can learn what it's doing. Or someone else who's more versed can look it over to make sure it doesn't delete every user or group in your environment.

' Specify Distinguished Name of OU. All users in this OU
' that are members of the specified group will be removed.
strOU = "ou=Sales,ou=West,dc=MyDomain,dc=com"

' Bind to specified OU.
Set objOU = GetObject("LDAP://ou=Sales,ou=West,dc=MyDomain,dc=com")

' Filter on group objects.
objOU.Filter = Array("group")

' Enumerate all groups in the OU.
For Each objGroup In objOU
' Enumerate all direct members of the group.
For Each objMember In objGroup.Members
' Retrieve DN of parent container/OU of member.
Set objParent = GetObject(objMember.Parent)
strParentDN = objParent.distinguishedName
' Compare to specified OU.
If (LCase(strParentDN) = LCase(strOU)) Then
' Remove the member from the group.
objGroup.Remove(objMember.AdsPath)
End If
Next
Next
share|improve this answer

Try using the Windows command line tools for Active Directory. I think the command you're looking for is dsrm.

I've found them very simple to use. The tools are installed on a server that has the AD DS and AD LDS Tools installed. On Windows Server 2008 R2 this located under Remote Server Administration Tools -> Remote Administration Tools. It is considered a Feature, not a Role.

The command to run would look something like this:

dsrm -subtree -exclude -noprompt -c 
                             "CN=Finance Users,OU=Finance,DC=fabrikam,DC=com"

I suggest testing it first, of course, but I believe that should work.

For more information on the command line tool to use see this: http://technet.microsoft.com/en-us/library/cc731865(v=ws.10).aspx

Other useful AD command line tools are:

dsadd
dsmod
dsquery
dsmove

Hope this helps.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.