Remove user from groups with Admodify

Is there a way with Admodify to remove a group of users from all groups excluding domain user in bulk?
There is no consistency with what users are associated to what groups for reference
LVL 1
GRV001Asked:
Who is Participating?
 
LauraEHunterMVPConnect With a Mentor Commented:
The reason this is trickier than you think is because group memberships are not stored as a property of the -user-, but of the -group-.  So to remove a user from every group that it is a member of, you need to:

[1] Enumerate the user's current group memberships
[2] Connect to each group that the user is a member of
[3] Delete the user from that group's 'member' attribute

As you can see, you need to modify each group in turn, it's not actually a function of modifying the user object.

Something like the following VBScript will accomplish what you're looking for on a single user object:

Const ADS_PROPERTY_DELETE = 4
Const E_ADS_PROPERTY_NOT_FOUND  = &h8000500D
 
Set objUser = GetObject("LDAP://<UserDN>")
arrMemberOf = objUser.GetEx("memberOf")
 
If Err.Number = E_ADS_PROPERTY_NOT_FOUND Then
    WScript.Echo "No group memberships found."
    WScript.Quit
End If
 
For Each Group in arrMemberOf
    Set objGroup = GetObject("LDAP://" & Group)
    objGroup.PutEx ADS_PROPERTY_DELETE, _
        "member", Array("<UserDN>")
    objGroup.SetInfo
Next

Hope this helps.

Laura E. Hunter - Microsoft MVP: Windows Server - Networking
0
 
Computer101Commented:
Forced accept.

Computer101
EE Admin
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.