0

In Active Directory, how do I efficiently remove all users from GroupA who are members of GroupB? Basically I want to subtract B from A.

Have now:

AAA         BBB
---         ---
Alice       Alice
Charlene    Bruce
Chuck       Chuck

Desired:

AAA         BBB
---         ---
            Alice
Charlene    Bruce
            Chuck

I have the user lists in csv at the moment but can reorganize quickly to something else if needed:

logon, group
alice, AAA
alice, BBB
bruce, BBB
...

I'm not an AD admin, just a user who has write privileges for these groups.

3
  • Down voters please explain why, so that I might learn from my mistakes. Thanks. Nov 5, 2015 at 7:25
  • This is considered a "write a script for me" question, a category of questions considered problematic by many of the people here.
    – Warren P
    Nov 11, 2015 at 14:53
  • 1
    I think people should communicate via comments first, not via downvotes as downvotes do not communicate anything, other than that this annoyed me, perhaps. But that's just me, I guess.
    – Warren P
    Nov 11, 2015 at 17:22

1 Answer 1

4

Powershell Active Directory Web Services. Comes with all Domain Controllers 2008 R2 or better by default.

# This foreach loop enumerates through all members of the AAA group.
Foreach ($Usr In Get-ADGroupMember -Identity 'CN=AAA,CN=Users,DC=Contoso,DC=com')
{
    # If the 'MemberOf' array of $Usr's group memberships contains 'BBB', then...
    If ((Get-ADUser $Usr.SamAccountName -Properties MemberOf).MemberOf -Contains 'CN=BBB,CN=Users,DC=contoso,DC=com')
    {
        # Remove that user from 'AAA'.
        Remove-ADGroupMember -Identity 'AAA' -Members $Usr.SamAccountName
    }
}

That will remove all members of group 'AAA' who are also members of group 'BBB'. No CSV needed.

If you are using less than Powershell 3, use Import-Module ActiveDirectory before you start using AD cmdlets.

2
  • took me a devil of a time to get the right CN= syntax for our weird AD setup, but this example was enough to get me through to the end of my first powershell script that does real work. Thanks! Oct 23, 2014 at 20:01
  • @mattwilki: You can always use this powershell query to get the correct DistinguishedName without having to do the search manually: Get-ADGroup [ad-group-name]
    – user320177
    Nov 3, 2015 at 12:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .