Home / server / Questions / 402827
In Process
Don
Asked: 2012-06-28 11:45:55 +0800 CST

How to select a user and remove all groups they are a member of using Powershell (with Quest)?

  • 772

I've read quite a bit online about this and thought I had found a solution, but it doesn't seem to be working like I would expect.

I am wanting to get a user based on the username I input, then remove all groups that it is a member of. Basically the same thing as going into ADUC, selecting the user, selecting the Member Of tab, highlighting everything (except domain users of course) and selecting remove.

Here's the command I'm trying to use:

Get-QADUser -Name $username | Remove-QADMemberOf -RemoveAll

Others have said online that it works for them, but so far it hasn't for me. It doesn't give an error, it accepts the command just fine, but when I look in ADUC, the groups are still there for the user.

Any suggestions as to what I may be doing wrong?

Executing from Windows 7 with domain admin rights, Exchange cmdlets and Quest snapin loaded.

Thanks!

powershell

2 Answers

  1. I am using the following in my Disable user script (only added the part of removing the group membership)

    $DisableIni = Read-host "Enter initials of the user you want to disable"
$DisableUser = Get-QADUser $DisableIni

# Check Groupmembership and populate the list to Notes
$groupmemberof=$DisableUser.memberof | Get-QADGroup
      Foreach ($Group in $groupmemberof)
    {$DisNotes = (get-qaduser $DisableIni).notes
    Set-qaduser $DisableIni -notes "$DisNotes $Group;"}

# Remove all memberships from the user except for "Domain Users"
$DisableUser.memberOf | Get-QADGroup | where {$_.name -notmatch '^users|domain users$'} | Remove-QADGroupMember -member $DisableIni

    why would i add the groups to notes you might ask, just in case i disabled the wrong user, it is always good to be able to undo ;)

    Hope you find it usefull

    • 1

  2. Old thread, but for anyone still searching try this:

    Get-QADUser -samaccountName *type-in-username-here* | Remove-QADMemberOf -RemoveAll

    For example: Get-QADUser -samaccountName SmithJ | Remove-QADMemberOf -RemoveAll

    • 1