0

In Active Directory, how do I efficiently remove all users from GroupA who are members of GroupB? Basically I want to subtract B from A.

Have now:

AAA         BBB
---         ---
Alice       Alice
Charlene    Bruce
Chuck       Chuck

Desired:

AAA         BBB
---         ---
            Alice
Charlene    Bruce
            Chuck

I have the user lists in csv at the moment but can reorganize quickly to something else if needed:

logon, group
alice, AAA
alice, BBB
bruce, BBB
...

I'm not an AD admin, just a user who has write privileges for these groups.

matt wilkie
  • 481
  • 4
  • 12
  • 28
  • Down voters please explain why, so that I might learn from my mistakes. Thanks. – matt wilkie Nov 05 '15 at 07:25
  • This is considered a "write a script for me" question, a category of questions considered problematic by many of the people here. – Warren P Nov 11 '15 at 14:53
  • 1
    I think people should communicate via comments first, not via downvotes as downvotes do not communicate anything, other than that this annoyed me, perhaps. But that's just me, I guess. – Warren P Nov 11 '15 at 17:22

1 Answers1

4

Powershell Active Directory Web Services. Comes with all Domain Controllers 2008 R2 or better by default.

# This foreach loop enumerates through all members of the AAA group.
Foreach ($Usr In Get-ADGroupMember -Identity 'CN=AAA,CN=Users,DC=Contoso,DC=com')
{
    # If the 'MemberOf' array of $Usr's group memberships contains 'BBB', then...
    If ((Get-ADUser $Usr.SamAccountName -Properties MemberOf).MemberOf -Contains 'CN=BBB,CN=Users,DC=contoso,DC=com')
    {
        # Remove that user from 'AAA'.
        Remove-ADGroupMember -Identity 'AAA' -Members $Usr.SamAccountName
    }
}

That will remove all members of group 'AAA' who are also members of group 'BBB'. No CSV needed.

If you are using less than Powershell 3, use Import-Module ActiveDirectory before you start using AD cmdlets.

Ryan Ries
  • 55,481
  • 10
  • 142
  • 199
  • took me a devil of a time to get the right CN= syntax for our weird AD setup, but this example was enough to get me through to the end of my first powershell script that does real work. Thanks! – matt wilkie Oct 23 '14 at 20:01
  • @mattwilki: You can always use this powershell query to get the correct `DistinguishedName` without having to do the search manually: Get-ADGroup [ad-group-name] –  Nov 03 '15 at 12:49