Remove a users name from all groups

hi,

When a user regins after disabling the account i manually go tom each group where ever he is a member and and remove his name from the group is it possible to run a script or is there a tool which can do this automatically.

Please help.

regards
Sharath
LVL 11
bsharathAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

LauraEHunterMVPCommented:
The following VBScript will accomplish what you're looking for:

Const ADS_PROPERTY_DELETE = 4
Const E_ADS_PROPERTY_NOT_FOUND  = &h8000500D
 
Set objUser = GetObject("LDAP://<UserDN>")
arrMemberOf = objUser.GetEx("memberOf")
 
If Err.Number = E_ADS_PROPERTY_NOT_FOUND Then
    WScript.Echo "No group memberships found."
    WScript.Quit
End If
 
For Each Group in arrMemberOf
    Set objGroup = GetObject("LDAP://" & Group)
    objGroup.PutEx ADS_PROPERTY_DELETE, _
        "member", Array("<UserDN>")
    objGroup.SetInfo
Next

This is from the Active Directory Cookbook, 2nd Edition (of which I am a co-author, shameless plug.  ;-))

Hope this helps.

Laura E. Hunter - Microsoft MVP: Windows Server - Networking
0
bsharathAuthor Commented:
Will this script ask me for the username or just delete any disable users in any group.
0
LauraEHunterMVPCommented:
In this script you manually specify the target username in this line:

Set objUser = GetObject("LDAP://<UserDN>"), where you will replace <UserDN> with the actual distinguished name of the user.  So it might look like:

Set objUser = GetObject("LDAP://cn=DisabledUser,ou=DisabledUsersOU,dc=mycompany,dc=com")
0
Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

bsharathAuthor Commented:
Can it search and remove without giving the Cn,OU,Dc as there ae different ou's in which the users are.
0
LauraEHunterMVPCommented:
No, you need to provide the fully Distinguished Name of the user in order for the script to know which object to modify.
0
bsharathAuthor Commented:
The cronical name of the object id

Development.plc.co.uk/Countries/IND/User Accounts/Former Colleagues/Sujatha Anbumani

How do i put this in place

Domain is development.plc.co.uk

User name is sujatha anbumani
0
LauraEHunterMVPCommented:
This DN would be expressed as

"cn=Sujatha Anbumani,ou=Former Colleagues,ou=User Accounts,ou=IND,ou=Countries,dc=development,dc=plc,dc=co,dc=uk"
0
bsharathAuthor Commented:
Hi put it like this and execute i get this error.

Const ADS_PROPERTY_DELETE = 4
Const E_ADS_PROPERTY_NOT_FOUND  = &h8000500D
 
Set objUser = GetObject("LDAP://"cn=Sujatha Anbumani,ou=Former Colleagues,ou=User Accounts,ou=IND,ou=Countries,dc=development,dc=plc,dc=co,dc=uk"")
arrMemberOf = objUser.GetEx("memberOf")
 
If Err.Number = E_ADS_PROPERTY_NOT_FOUND Then
    WScript.Echo "No group memberships found."
    WScript.Quit
End If
 
For Each Group in arrMemberOf
    Set objGroup = GetObject("LDAP://" & Group)
    objGroup.PutEx ADS_PROPERTY_DELETE, _
        "member", Array("<UserDN>")
    objGroup.SetInfo
Next



Error



C:\>cscript s.vbs
Microsoft (R) Windows Script Host Version 5.6
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.

C:\s.vbs(4, 34) Microsoft VBScript compilation error: Expected ')'
0
LauraEHunterMVPCommented:
It compiles using a test user on my domain.  Be sure that the "Set objUser=" line is not wrapping across multiple lines.  There should also be only one set of quotes, just ("LDAP://cn=....dc=uk")
0
bsharathAuthor Commented:
Now i get this


C:\>cscript s.vbs
Microsoft (R) Windows Script Host Version 5.6
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.

C:\s.vbs(4, 1) (null): A referral was returned from the server.
0
LauraEHunterMVPCommented:
This means that you have specified the DN of the user incorrectly.  

You can open the user object in ADSI Edit (in the Microsoft Support Tools) to retrieve the DN of the user object in question.

If you are unfamiliar with Active Directory scripting, I recommend the tutorials at the following site: http://www.activexperts.com/activmonitor/windowsmanagement/adminscripts/usersgroups/users/
0
czcdctCommented:
OK, I might be speaking out of turn here but unless you are making a script to disable the account, move the user account to the other OU and then remove the membership, can't you just go to his account and into the Member Of tab and remove everything there.

Sorry. I'll run away now.
0
bsharathAuthor Commented:
czcdct:

As we add the user to the member the group does not display in the users properties
0
bsharathAuthor Commented:
LauraEHunterMVP:

Any help on this....
0
czcdctCommented:
Ah, so the question is completely different then, isn't it. Your problem is that adding a user to a group does not result in that group appearing in the "Member Of" box on the user account. I'm certainly not that much of an expert to troubleshoot that one too deeply. Perhaps Laura will give you the solution. She's good like that.
0
bsharathAuthor Commented:
When i disable a user need to automatically remove the user from all groups where he is a member.

0
LauraEHunterMVPCommented:
I don't understand what further help you are requesting.  If your goal is to strip a user of all of its group memberships, the best solution is the script that I've already provided.
0
bsharathAuthor Commented:
LauraEHunterMVP:

Can you please post the whole script with all the changes.I shall try now
0
LauraEHunterMVPCommented:
The script is fine as-written.  Place the user object's distinguished name where you see the <UserDN> placeholder, being careful not to add quotes around the DN and ensuring that each line of the script appears on one continuous line.  
0
bsharathAuthor Commented:
I get this error.If you sort this error.I think i can sole the issue
---------------------------
Windows Script Host
---------------------------
Script:      C:\Gr.vbs
Line:      4
Char:      34
Error:      Expected ')'
Code:      800A03EE
Source:       Microsoft VBScript compilation error

---------------------------
OK  
---------------------------
0
LauraEHunterMVPCommented:
You are specifying the DN of the user incorrectly. Be sure that it is written on a single line in the format listed in previous comments.
0
bsharathAuthor Commented:
This is the code what i am using

Const ADS_PROPERTY_DELETE = 4
Const E_ADS_PROPERTY_NOT_FOUND  = &h8000500D
 
Set objUser = GetObject("LDAP://"cn=Sujatha Anbumani,ou=Former Colleagues,ou=User Accounts,ou=IND,ou=Countries,dc=development,dc=plc,dc=co,dc=uk"")
arrMemberOf = objUser.GetEx("memberOf")
 
If Err.Number = E_ADS_PROPERTY_NOT_FOUND Then
    WScript.Echo "No group memberships found."
    WScript.Quit
End If
 
For Each Group in arrMemberOf
    Set objGroup = GetObject("LDAP://" & Group)
    objGroup.PutEx ADS_PROPERTY_DELETE, _
        "member", Array("<UserDN>")
    objGroup.SetInfo
Next
Error

Please suggect where i am going wrong

I have checked the cronical name of object which show as this.

Development.plc.co.uk/Countries/IND/User Accounts/Former Colleagues/Sujatha Anbumani
0
LauraEHunterMVPCommented:
As I have stated previously, the user DN needs to appear on a single line.

As I have -also- stated previously, there should also be only one set of quotes, just ("LDAP://cn=....dc=uk")

To circumvent your next "It's still not working" request: you also need to replace the text (<User DN>) with the actual DN of the user in question.

Understand that we can only provide you with example scripts - you need to be sufficiently capable of modifying these scripts to fit your own environment.  If you follow the recommendations that I have already made in this thread, this script will perform the task you are requesting. It is now up to you to configure the example script properly for your own environment; as I cannot do your job for you, I cannot assist you any further.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft Server OS

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.