Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've read quite a bit online about this and thought I had found a solution, but it doesn't seem to be working like I would expect.

I am wanting to get a user based on the username I input, then remove all groups that it is a member of. Basically the same thing as going into ADUC, selecting the user, selecting the Member Of tab, highlighting everything (except domain users of course) and selecting remove.

Here's the command I'm trying to use:

Get-QADUser -Name $username | Remove-QADMemberOf -RemoveAll

Others have said online that it works for them, but so far it hasn't for me. It doesn't give an error, it accepts the command just fine, but when I look in ADUC, the groups are still there for the user.

Any suggestions as to what I may be doing wrong?

Executing from Windows 7 with domain admin rights, Exchange cmdlets and Quest snapin loaded.

Thanks!

share|improve this question
    
Are you executing from an elevated command prompt? I've had the Quest plugins fail silently when I've forgotten to do so. –  Tim Brigham Jun 27 '12 at 19:58
    
I hadn't tried that specifically, but just did. Seems to have responded the same way. It runs without throwing an error, but the groups are still there. Thanks for the suggestion though! –  Don Jun 27 '12 at 20:13
    
are you looking at the same DC you are executing the command against? Perhaps the changes haven't replicated yet. –  Jim B Jun 28 '12 at 3:04
    
Yeah, I thought that as well. I'm authenticated against the same DC from my PC that I am connected to with ADUC. I forced replication between sites, as well as waited a bit and checked back just to be sure. Good suggestion though. –  Don Jun 28 '12 at 12:55
    
Have you tried running with WhatIf to see if it returns anything at all? I am also wondering if perhaps what is going on is that the Get-QADUser command is not returning anything to pass down the pipe. Have you checked to be sure that it is indeed returning the desired account? –  Christopher Jul 3 '12 at 18:46
show 1 more comment

1 Answer 1

I am using the following in my Disable user script (only added the part of removing the group membership)

$DisableIni = Read-host "Enter initials of the user you want to disable"
$DisableUser = Get-QADUser $DisableIni

# Check Groupmembership and populate the list to Notes
$groupmemberof=$DisableUser.memberof | Get-QADGroup
      Foreach ($Group in $groupmemberof)
    {$DisNotes = (get-qaduser $DisableIni).notes
    Set-qaduser $DisableIni -notes "$DisNotes $Group;"}

# Remove all memberships from the user except for "Domain Users"
$DisableUser.memberOf | Get-QADGroup | where {$_.name -notmatch '^users|domain users$'} | Remove-QADGroupMember -member $DisableIni

why would i add the groups to notes you might ask, just in case i disabled the wrong user, it is always good to be able to undo ;)

Hope you find it usefull

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.