I'm looking for a way to remove ALL users from a list of Active Directory groups.

For example I have a txt file with a bunch of group names, and I'd like to go through all of them and remove all the users inside of them.

A way to do it without using a text file would work as well, but I have a very large amount of groups that need to have this done, and might need to in the future as well ( possibly periodically ).

This is what I'm working with now :

Set objGroup = GetObject("LDAP://CN=Finance Users,OU=Finance,DC=fabrikam,DC=com") 

For Each strUser in objGroup.Member 
    objGroup.PutEx ADS_PROPERTY_DELETE, "member", Array(strUser) 


3 Answers 3


Powershell. Put all your groups into ingroups.txt, one per line. Save script as .ps1 file, and then execute.

function removeAllUsersFromGroup{
    BEGIN   { Import-Module ActiveDirectory; if ($GroupName -eq ""){ throw "No group name specified" } Write-Host "Removing users from $GroupName" -f green }
    PROCESS { 
        $groupSID = (Get-ADGroup "Test Group").SID
        $groupMembers = Get-ADGroupMember -Identity $groupSID

        foreach ($member in $groupMembers){
            Remove-ADGroupMember -Identity $groupSID -Member $member.SID
    END     {  }

Get-Content .\ingroups.txt | %{ removeAllUsersFromGroup-groupname $_}

You must have the Windows RSAT installed, as it uses the Active Directory cmdlets. If a group does not exist, or is empty, you will get some powershell errors.

  • +1 Brushing up on your PS, I see. :D
    – MDMarra
    Mar 6, 2012 at 15:46
  • @MDMarra - yep. Been hammering it at work these past few weeks, figured I should share. Mar 6, 2012 at 19:20

Set objGroup = GetObject("LDAP://cn=Finance Users,ou=Finance,dc=fabrikam,dc=com") 

objGroup.PutEx ADS_PROPERTY_CLEAR, "member", 0

I use that to remove the users from a certain group.

I think a good solution for you would be to remove the members of ALL groups in a Certain OU, that would be much cleaner.


I actually found something that might work better, might want to run it in a test environment first, so you can learn what it's doing. Or someone else who's more versed can look it over to make sure it doesn't delete every user or group in your environment.

' Specify Distinguished Name of OU. All users in this OU
' that are members of the specified group will be removed.
strOU = "ou=Sales,ou=West,dc=MyDomain,dc=com"

' Bind to specified OU.
Set objOU = GetObject("LDAP://ou=Sales,ou=West,dc=MyDomain,dc=com")

' Filter on group objects.
objOU.Filter = Array("group")

' Enumerate all groups in the OU.
For Each objGroup In objOU
' Enumerate all direct members of the group.
For Each objMember In objGroup.Members
' Retrieve DN of parent container/OU of member.
Set objParent = GetObject(objMember.Parent)
strParentDN = objParent.distinguishedName
' Compare to specified OU.
If (LCase(strParentDN) = LCase(strOU)) Then
' Remove the member from the group.
End If

Try using the Windows command line tools for Active Directory. I think the command you're looking for is dsrm.

I've found them very simple to use. The tools are installed on a server that has the AD DS and AD LDS Tools installed. On Windows Server 2008 R2 this located under Remote Server Administration Tools -> Remote Administration Tools. It is considered a Feature, not a Role.

The command to run would look something like this:

dsrm -subtree -exclude -noprompt -c 
                             "CN=Finance Users,OU=Finance,DC=fabrikam,DC=com"

I suggest testing it first, of course, but I believe that should work.

For more information on the command line tool to use see this: http://technet.microsoft.com/en-us/library/cc731865(v=ws.10).aspx

Other useful AD command line tools are:


Hope this helps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.