I currently have a file where I run a DSQUERY on users within a specific OU Which I then PIPE into a DSMOD USER so that i can change the Description on the Accounts.
When this is done I then end up with a DSMOVE to move the Account into another OU. This all works fine but I know want to also remove the USERS from all the groups they maybe a part of.
The current text I'm using to do all the above barring the removing from groups is as follows:
dsquery user "OU=Disabled Accounts,OU=Data Has Been Archived,OU=base,OU=Staff,
For /F "delims=*" %%u IN ('dsquery user -desc Archived* "OU=Disabled Accounts,OU=Data Has Been Archived,OU=Base,OU=Staff,
Many thanks for anyones help
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Hi Dusan
That seems to be near enough what I need except it leaves one group other than the Domain users (That I know of)
That group is our Broadcast all staff Group which is our Distribution list for all staff for mass email. The Group itselfs is set up as a Security type. I know group mod can only do a 100 groups unless you set the limit to more, but where abouts would i set this limit on what you have written?
Many thanks
dsmod command in this script removes only one user from one group at each pass. You could hit 100 users limit at "dsquery user" command (and you can fix that with "-limit 1000" ) but in that case you would be left with some users that have intact their group membership.
Is any user successfully removed from that group?
Can you check from AD Users GUI "member of" tab for some of the users, is that group still listed?
Can you run cmd "dsquery user" and "dsget user" commands from script manually and see results?
See below for the code this happens for most groups.....I'm not convinced its searching all the groups within the domain because of how quick it happens
C:\>(dsmod group "CN=Users,CN=Builtin,DC=co
r Soards,OU=Data Has Been Archived,OU=Base,OU=Staff,
Home,DC=ac,DC=uk" )
dsmod failed:CN=Users,CN=Builtin
name is not a member of the local group.:CN=USER NAME,OU=Data Has Been Archi
ved,OU=Base,OU=Staff,OU=Ac
t be removed from the group.
type dsmod /? for help.
For /F "delims=*" %%w IN ('dsquery user -desc Archived* "OU=Data Has Been Archived,OU=Base,OU=Staff,
For /F "delims=*" %%g IN ('dsget user %%w -memberof -expand') DO (
dsmod group %%g -rmmbr %%w
)
)
1. Script uses dsquery user to get list of all users from "OU=Data Has ... ... ,DC=uk" with "Archived*" description (check please if I made any typing errors!).
2. First FOR loop goes through that list and for each user lists groups that one particular user is member of ("dsget user" uses -memberof switch to get that list)
3. Second FOR loop goes through that list of groups and removes user using "dsmod group".
I created OU on my domain and added few test users and joined them into random groups, script did its job with no mistake.
Let's troubleshoot each step. First run at cmd prompt:
dsquery user -desc Archived* "OU=Data Has Been Archived,OU=Base,OU=Staff,
Do you get list of users you need to process?
OK interestingly I've found that another group that is in the same OU as the broadcast all staff dont get removed either.
I added a group (Itservices) from the same OU that the Broadcast group is in and then run the script, And the two were there, this lead me to think may its that OU that the groups were based in but I then added a third random one from the OU and the script removed it as it should do but still left me with the Broadcast and ITServices...
heres another piece of investing
I have 3 groups (BroadcastALL STAFF,ITService,NIS) all in the same OU and two of them dont remove (BroadcastALLStaff and ITServices) but one does (NIS), so I run
Dsquery user "OU=Blah,OU=Blah,DC=Home,D
that showed exactly what I expected the the groups the users were part of and theres nothing untoward the out except one thing..theres a \ before the names of BroadcastALLSTAFF and ITservices eg:
"CN=\ IT Services,OU=E-Mail Groups and Users
But theres not for the NIS so that outputs as
CN=NIS Team,OU=E-Mail Groups and Users
So I'm guessing its the \ thats stopping them groups from being removed?? Any ideas on how to get round that?
k
i get the following error when run for the IT Services or BroadcasALLStaff
dsmod failed:Value for `Target object for this command' has incorrect format.
type dsmod /? for help.
But its successful for NIS
i dont know where the "CN=\ IT Services" is coming from as I would have thought that that should have been "CN=IT Services"
What you cant go home!! HAHA no thank you, you're help is appreciated i'll give it some thought also. I've checked the Groups and theres nothing strange about the names etc, and they, well BroadcastALLStaff will have been around since the damn of time, I'll see if theres other groups dating back to then and see if they have the same effect....its def the \ thats missing it up
its a space before the name of the group, at least thats what i think
Fro example the Canonical name of NIS is
Home.co.uk/E-Mail Groups and Users (Exchange)/NIS
Buts for ITServices its
Home.ac.uk/E-Mail Groups and Users (Exchange)/ IT Services
Thus i dont think it likes the space, but i dont know how to get around that? ad we have a few groups like this
OK, can you try this please:
SETLOCAL ENABLEDELAYEDEXPANSION
set u=
set w=
set g=
set qwe=
For /F "delims=*" %%w IN ('dsquery user -desc Archived* "OU=Data Has Been Archived,OU=Base,OU=Staff,
For /F "delims=*" %%g IN ('dsget user %%w -memberof -expand') DO (
set qwe=%%g
set qwe=!qwe:\ = !
dsmod group "!qwe!" -rmmbr %%w
)
)
Copied and pasted exactly what you have there I get two errors
I get
1) dsmod failed:Value for `Target object for this command' has incorrect format.
2) dsmod failed:`-' is an unknown parameter.
1 refers to the \ broadcastallstaff group
and i think 2 refers to a group that is something like ISA - SET PROXY
can you try again with this and paste error
SETLOCAL ENABLEDELAYEDEXPANSION
set u=
set w=
set g=
set qwe=
For /F "delims=*" %%w IN ('dsquery user -desc Archived* "OU=Data Has Been Archived,OU=Base,OU=Staff,
For /F "delims=*" %%g IN ('dsget user %%w -memberof ') DO (
set qwe=%%g
set qwe=!qwe:\ = !
dsmod group !qwe! -rmmbr %%w
)
)
Business Accounts
Answer for Membership
by: Dusan_BajicPosted on 2009-11-03 at 08:45:23ID: 25730826
This will list members of OU, for each member it will list groups, then it will remove member from each group. User will remain member of his primary group (Domain Users)
For /F "delims=*" %%w IN ('dsquery user -desc Archived* "OU=Data Has Been Archived,OU=Base,OU=Staff,
For /F "delims=*" %%g IN ('dsget user %%w -memberof -expand') DO (
dsmod group %%g -rmmbr %%w
)
)