Powershell script to check each Security group which are not mail enabled and remove an contacts from those groups.

Quest again will be the best bet for things that aren't mail enabled.

Can you check and see if this is returns the right groups please?


Get-QADGroup -SearchRoot "OU=groups,DC=domain,DC=com" -SizeLimit 0 `
  -LdapFilter "(!(legacyExchangeDN=*))"


If it does, we can extende that to do away with the contacts with the script below.

Chris

# Get the groups
Get-QADGroup -SearchRoot "OU=groups,DC=domain,DC=com" -SizeLimit 0 `
    -LdapFilter "(!(legacyExchangeDN=*))" | ForEach-Object {

  $Group = $_

  # Get the contacts from the group
  Get-QADGroupMember $Group.DN -Type Contact | ForEach-Object {

    # Log file output
    $_ | Select-Object @{n='GroupName';e={ $Group.Name }},
      Name, DN

    # Remove the member from the group
    Remove-QADGroupMember $Group.DN -Member $_.DN | Out-Null
  }
# Write the log file
} | Export-Csv "LogFile.csv"

Select allOpen in new window

ou want me to run this to test

Get-QADGroup -SearchRoot "OU=groups,DC=domain,DC=com" -SizeLimit 0 `
  -LdapFilter "(!(legacyExchangeDN=*))"
Hope it just check and does not changes

Hope it querys just non Mail enabled Security groups. Even though the OU has Mail enabled Security groups

That's the intent. The version directly above is safe to run, no changes, just reporting.

Chris

Ok now to actually run can i remove this
-WhatIf

will that be enough

Yes, that's all :)

Chris

Thank ou Chris worked perfect
any help with this
https://www.experts-exchange.com/questions/26295206/Script-To-check-All-The-Users-who-is-set-to-Change-The-Password-On-Next-Logon.html