I am doing a cleanup of some AD groups that are no longer used. One of the AD groups I could not delete because it seems that a member has this group set as the primary group (which I assume someone did by accident). Is there an easy way to find out who has this group set as primary?
3 Answers
You'll need to get the primaryGroupToken value of the group in question:
- Use adsiedit to examine the group you want to get delete. Make note of the primaryGroupToken attribute's value.
Create a Saved Query in Active Directory Users and Computers using the following "Custom Search" where XXX= the value you found for primaryGroupToken:
(&(objectCategory=person)(objectClass=user)(primaryGroupID=XXX))
Refresh the query to see who shows up
Alternatively - If all users are expected to be members of Domain Users as their primary group, just define the query using(513 is the typical value for Domain Users):
(&(objectCategory=person)(objectClass=user)(!primaryGroupID=513))
Additional Links:
http://support.microsoft.com/default.aspx?scid=kb;en-us;321360 http://support.microsoft.com/default.aspx?scid=kb;en-us;297951
Great Question!
Just by giving the privileges
To delete windows group in Active directory
Open notepad
Copy and paste below text to notepad
Save the file with .ps1 extension.
---------- SCRIPT STARTS HERE--------------
VERSION 2
4/19/2010
script to modify termed users
1.pull termed users from CSV
remove user group membership
2.Clear Manager property
3.Hide from GAL
4.move to disabed OU
5.rename csv to completed date, move to completed
$groupmembershiplog="c:\removeADAttributes\group_membership_log.csv" $erroractionpreference = "SilentlyContinue" $termfile=Test-Path -Path "C:\removeADAttributes\termed_employees.csv" If ($termfile -eq "True") { $inputcsv="C:\removeADAttributes\termed_employees.csv" $completeddir="C:\removeADAttributes\completed\" $date=Get-Date -format d
import-CSV $inputcsv | foreach-object { $username=$_.account
export groups to file
$groups=(Get-QADUser $username).memberof Add-Content $groupmembershiplog $username","$groups
remove groups
$groups | Get-QADGroup | where {$_.name -ne "domain users"} | Remove-QADGroupMember -Member $name Set-QADUser -Identity $username -objectattributes @{"Manager"="$null"} $currentuser=Get-QADUser -Identity $username -SizeLimit 1 $currentOU=$currentuser.parentcontainer $currentOU = $currentOU.Split('/') $currentOU = $currentOU[1] Move-QADObject -identity $username -NewParentContainer "domainname.com/$ou/Disabled Accounts" }
import-CSV $inputcsv | foreach-object { $username=$.account Add-PSSnapin Microsoft.Exchange.Management.PowerShell.Admin Set-Mailbox -Identity $username -HiddenFromAddressListsEnabled $true } import-CSV $inputcsv | foreach-object { $username=$.account Add-Content "C:\removeADAttributes\removeADAttributes_log.csv" $date","$username }
Move-Item $inputcsv -Destination $completeddir $todaydate=$date.replace("/","_") $newfilename=$todaydate+".csv" Rename-Item "C:\removeADAttributes\completed\termed_employees.csv" -NewName $newfilename
} else { $date=Get-Date -format d Add-Content "C:\removeADAttributes\removeADAttributes_log.csv" $date",no term user, no term user" exit }
---------- SCRIPT ENDSS HERE------------
Hope this scripts will be useful for you
I know this is a old thread but for people having this same issue. If you are removing the group anyways there is a easier method.
- Open the group and go to the members tab.
- Select all the users
- Remove the users.
- One of the users that are left has the group as the primary. For me it was the user with the lowest alphabetical name.
- Change the primary group for that user
- Delete group or repeat to find other users with this group as the primary.
-
1this can prove unacceptably time-consuming. There are scripting\automated ways of doing this as well. Aug 15, 2011 at 17:20