Testing group membership

Hi guys, hope you are all well and can assist.

We want to work on a process of testing group membership scenarios.

Basically, we want to do the following:

1) User Bob is a member of 15 groups > Export all groups to a text file called exportedgroups.txt

2) Remove all groups from User Bob's account, except for domain users.

3) Do testing with User Bob's account.

4) After testing, readd all groups that were removed by step 2) above, back to user Bob's account.


Step 1) is done via:

dsquery user -name <username> -d <domainname> | dsget user -memberof > exportedgroups.txt

Format of exportedgroups.txt is as follows:

"CN=d_AN_Users,OU=domain Groups,DC=ori,DC=domain,DC=net"
"CN=w_ho_cor_hr_services_c,OU=Groups,OU=AN,OU=Migrated Objects,DC=ori,DC=domain,DC=net"
"CN=w_ho_cor_payr_proj_c,OU=Groups,OU=AN,OU=Migrated Objects,DC=ori,DC=domain,DC=net"

Step 2) is not done:
We need a way to remove all groups from his account EXCEPT for domain users.

Step 3) does not need to be done (we will do this).

Step 4) is not done.

Any help on this greatly appreciated.
Who is Participating?
Krzysztof PytkoConnect With a Mentor Senior Active Directory EngineerCommented:
you're welcome :) That's no problem. If you need further assistance, please let me know

Krzysztof PytkoSenior Active Directory EngineerCommented:
I would also use DS Tools as you did it and

dsquery user -name "Bob" | dsget user -memberof c:\exportedgroups.txt

Now, remove "Domain Users" group from that text file

for /f %i in (c:\exportedgroups.txt) do dsquery user -name "Bob" | dsmod group %i -rmmbr

Bob will be removed from all of those groups, except Domain Users (because you deleted it from text file)

as you mentioned :]

for /f %i in (c:\exportedgroups.txt) do dsquery user -name "Bob" | dsmod group %i -addmbr

And re-add Bob into groups from text file :)

If you need more assistance, just let me know

Krzysztof PytkoSenior Active Directory EngineerCommented:
Sorry forget about ">" in this syntax, should be

dsquery user -name "Bob" | dsget user -memberof >c:\exportedgroups.txt

Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

Krzysztof PytkoSenior Active Directory EngineerCommented:
OK, if your groups or OUs have space in names, you need to modify AD2 and AD4

First, in text file add at the end of each line ";" (semicolon)

and use this syntax

for /f %i "tokens=* delims=;" in (c:\exportedgroups.txt) do dsquery user -name "Bob" | dsmod group %i -rmmbr

for /f %i "tokens=* delims=;" in (c:\exportedgroups.txt) do dsquery user -name "Bob" | dsmod group %i -addmbr

Simon336697Author Commented:
Thanks so much iSiek. I will test this now. Sorry about the delay.
Simon336697Author Commented:
Thanks iSiek sorry about the delay getting back to you.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.