Solved

How to remove group membership automatically?

Posted on 2009-07-07
6
1,093 Views
Last Modified: 2012-05-07
Hello,

After disabling certain user accounts, i placed them in an OU called "Decommissioned".  I need to run a script its main function is to remove any group (security or dist.) that these accounts are members. I need the script to run  against a specific OU.

Appreciate your fast response in this.

Thanks

Yassein
0
Comment
Question by:amyassein
  • 4
  • 2
6 Comments
 
LVL 6

Expert Comment

by:Krisdeep
ID: 24793400
This site might help and add this maybe to a schedule task maybe once a day or add a timer in the vbs script.

http://www.phwinfo.com/forum/ms-win-server-scripting/355024-script-ad-remove-all-members-groups-ou.html
0
 
LVL 1

Author Comment

by:amyassein
ID: 24795831
Kris,

Thank you .... However, this forum dicuss a script that removes members from a group that are in a specific OU. For example, users in Marketing OU to be removed from the Marketing group.

What i ask for is the complete opposite, my requirement is a script to remove the groups from the user accounts where they reside in an OU named Decommissioned and each account in this OU is a member in different groups.

The goal from the beginning is that after disabling these user accounts, i want also to remove them from any groups since they are disabled. So i place them in an Decommissioned OU and then remove their groups as well.

Can i do that using a script?

Thanks

0
 
LVL 6

Accepted Solution

by:
Krisdeep earned 250 total points
ID: 24812927
Credit to Richard Mueller [MVP]
I have tested this can you confirm if it works for you. It removes all the group except the default domain users group.

Option Explicit

Dim objOU, objUser, arrGroups, strGroup, objGroup
Dim objGroupList

' Bind to OU object.
Set objOU = GetObject("LDAP://ou=Test,dc=Cisco,dc=com")

' Filter on objects of class user.
objOU.Filter = Array("user")

' Create dictionary object of group objects.
Set objGroupList = CreateObject("Scripting.Dictionary")
objGroupList.CompareMode = vbTextCompare

' Enumerate users in OU.
For Each objUser In objOU
' Enumerate direct group memberships.
' Trap error if there are no groups.
' Primary group is not included.
On Error Resume Next
arrGroups = objUser.GetEx("memberOf")
If (Err.Number = 0) Then
On Error GoTo 0
For Each strGroup In arrGroups
' Check if group already bound.
If (objGroupList.Exists(strGroup) = False) Then
' Add group object to the dictionary object.
Set objGroupList(strGroup) = GetObject("LDAP://" & strGroup)
End If
' Remove user from the group.
objGroupList(strGroup).Remove(objUser.AdsPath)
Next
End If
On Error GoTo 0
Next
0
Are your AD admin tools letting you down?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

 
LVL 6

Expert Comment

by:Krisdeep
ID: 24812954
The only settings that you have to change above is
' Bind to OU object.
Set objOU = GetObject("LDAP://ou=Test,dc=Cisco,dc=com")

If your not sure let me know.
0
 
LVL 1

Author Comment

by:amyassein
ID: 24823128
Kris,

Thank you so much for the valuable information. Let me test your script and i will update you.  

By the way, In the "Bind to OU Object", shall i have to put my "Decommissioned" OU?

Thanks
0
 
LVL 6

Expert Comment

by:Krisdeep
ID: 24828447
"By the way, In the "Bind to OU Object", shall i have to put my "Decommissioned" OU?"

Yes that will be your location of your Decommissioned OU.
0

Featured Post

Backup Your Microsoft Windows Server®

Backup all your Microsoft Windows Server – on-premises, in remote locations, in private and hybrid clouds. Your entire Windows Server will be backed up in one easy step with patented, block-level disk imaging. We achieve RTOs (recovery time objectives) as low as 15 seconds.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Setting up a Microsoft WSUS update system is free relatively speaking if you have hard disk space and processor capacity.   However, WSUS can be a blessing and a curse. For example, there is nothing worse than approving updates and they just have…
ADCs have gained traction within the last decade, largely due to increased demand for legacy load balancing appliances to handle more advanced application delivery requirements and improve application performance.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …

816 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

8 Experts available now in Live!

Get 1:1 Help Now