Avatar of MD187
MD187
 asked on

remove specific users from specific groups

Hey all,

I have a task to remove specific users from specific groups from a list.  

the script needs to use sAMAccountName's of the users and groups from a list formatted as follows:

groupname1;username1
groupname2;username2

i have a script that adds the users to the groups, but now i need to reverse it. As a noob to scripting, any help would be appreciated. Thanks all.
Active DirectoryPowershellScripting Languages

Avatar of undefined
Last Comment
MD187

8/22/2022 - Mon
yo_bee

Can you post your script?
MD187

ASKER
Sure thing,


Here is what i have for adding users:


ON ERROR RESUME NEXT

Dim DisplayEcho
Const ADS_PROPERTY_APPEND = 3

'---------------------------------------------------------------------------
'      User Variables
'---------------------------------------------------------------------------
'OU where groups are located
strOU="ou=temp,ou=test,dc=somewhere,dc=com"

'text file groups & users
'line format:  Group Name;User Name1;User Name2;
strTextFilename="C:\Groups.txt"

strLogFileName="C:\results.txt"

'True to display echos, false to hide
DisplayEcho = True
'---------------------------------------------------------------------------

Set WshShell=CreateObject("Wscript.Shell")
Set fso=CreateObject("Scripting.FileSystemObject")

If DisplayEcho=True then
      'Force CSCRIPT
      If instr(lcase(wscript.fullname),"wscript") then
            wshshell.run "cmd /k cscript //nologo " & chr(34) & wscript.scriptfullname & Chr(34),1,false
            wscript.quit
      End If
End If

Set oLogFile=fso.OpenTextFile(strLogFileName,2,true)

Set oFile=fso.OpenTextFile(strTextFilename,1)
text=oFile.ReadAll
oFile.close

arrText=split(text,vbCrLf)


For each line in arrText
      arrLine=split(line,";")
      strGroup=arrLine(0)
      err.Clear
      strGroupPath=GetADsPath(strGroup,"group")
     
      If strGroupPath = "" then
            Output "ERROR: Could not find group:  " & strGroup
            err.clear
      Else
                  Set objGroup = GetObject(strGroupPath)
            For i = 1 to ubound(arrLine)
                  strUser=arrLine(i)
                  strADsPath_user=GetADsPath(strUser,"user")
                  Set objUser=GetObject(strADsPath_user)
                  strUserDN=objUser.DistinguishedName
                  If strUserDN="" then
                        Output strGroup & "... Could not find user:  " & strUser
                  Else
                        objGroup.PutEx ADS_PROPERTY_APPEND, _
                              "member", Array(strUserDN)
                        objGroup.SetInfo
           
                        If err.number <> 0 then
                              If err.number="-2147019886" then
                                    Output strGroup & " <-- " & strUser & " (Already a member)"
                              Else
                                    Output "ERROR adding " & strUser & " to " & strGroup & vbCrLf & _
                                          vbTab & err.number & " " & err.description
                              End If
                              err.clear
                        Else
                              'show successful additions
                              Output strGroup & " <-- " & strUser
                        End If
                  End If
                  strUser=""
                  strUserDN=""
                  strADsPath_user=""
                  Set objUser=Nothing
            Next
           
      End If

      Set objGroup=Nothing
      arrLine=""
      strGroup=""

Next

oLogFile.close

Output ""
Output "Operation complete.  See Log:  " & strLogFileName


Sub Output(txt)
      If DisplayEcho=True then wscript.echo txt
      oLogFile.writeLine txt
End Sub



Function GetADsPath(myName,myType)
      Const ADS_SCOPE_SUBTREE = 2

      strADsPath=""

      Set objRootDSE = GetObject("LDAP://rootDSE")
      strRootDSE = objRootDSE.Get("defaultNamingContext")      

      Set objConnection = CreateObject("ADODB.Connection")
      Set objCommand =   CreateObject("ADODB.Command")
      objConnection.Provider = "ADsDSOObject"
      objConnection.Open "Active Directory Provider"
      Set objCommand.ActiveConnection = objConnection
     
      objCommand.Properties("Page Size") = 1000
      objCommand.Properties("Searchscope") = ADS_SCOPE_SUBTREE
     
      objCommand.CommandText = _
            "SELECT ADsPath FROM 'LDAP://" & strRootDSE & "' WHERE objectCategory='" & myType & "' " & _
                  "AND Name ='" & myName & "' "
     
      Set objRecordSet = objCommand.Execute
     
      objRecordSet.MoveFirst
      strADsPath = ""
      strADsPath= objRecordSet.Fields("ADsPath").value

      GetADsPath=strADsPath
     
      Set objConnection=Nothing
      Set objCommand=Nothing
      Set objRecordSet=Nothing
End Function
yo_bee

Try this since you have a working Add User script.
Add Const ADS_PROPERTY_DELETE = 4
then replace ADS_PROPERTY_APPEND

I recommend trying this against a test group for confirmation.

Where did you get this script from.  Is seems pretty complex for a noob?
Your help has saved me hundreds of hours of internet surfing.
fblack61
SubSun

In case you are interested in PowerShell, you can try this script..
#<Sample CSV format
Group,Member
groupname1;username1
groupname2;username2
#>
Import-module activedirectory
Import-Csv c:\test.csv | %{
Remove-ADGroupMember -Identity $_.Group -Members $_.Member -Confirm:$false}

Open in new window

yo_bee

@Subsun

The PS Import-CSV needs the -Delimiter ";" switch to address his ; format. If that is not there it will not work. I put together a post last night, but must not have pushed submit.
The script was identical to yours accept for the -delimiter switch.
SubSun

Thanks for pointing out.. I just copy pasted the group name and user name from the user post but forgot change the semicolon to comma.. If you use coma the you don’t require the parameter -Delimiter with import-csv..

Correct CSV format
Group,Member
groupname1,username1
groupname2,username2

Open in new window

BTB  -Delimiter ";" will not work for the sample file mentioned in my post because the header is separated with comma..
⚡ FREE TRIAL OFFER
Try out a week of full access for free.
Find out why thousands trust the EE community with their toughest problems.
SOLUTION
yo_bee

THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
GET A PERSONALIZED SOLUTION
Ask your own question & get feedback from real experts
Find out why thousands trust the EE community with their toughest problems.
SubSun

Spot the difference my friend.. :-)  

My script input Group,Member (This will not work with -Delimiter ';', and that's why I posted Correct CSV format)

You modified the script input Group;Member (This will work with -Delimiter ';')

That's what I said in my previous comment "BTB  -Delimiter ";" will not work for the sample file mentioned in my post because the header is separated with comma.. "
yo_bee

Sorry.
SubSun

That's fine.. I just wanted to printout the difference.. :-)
Experts Exchange is like having an extremely knowledgeable team sitting and waiting for your call. Couldn't do my job half as well as I do without it!
James Murphy
MD187

ASKER
Thank you both for the work on this, PS is a much more "elegant" solution over VB.  Yo_bee, the script was put together by myself, with a lot of help from a former college who has since left my organization.  I may go back and change the "add user VB script" to PS.  

Can that be done by changing:  
Remove-ADGroupMember -Identity $_.Group -Members $_.Member -Confirm:$false}

to:
Add-ADGroupMember -Identity $_.Group -Members $_.Member -Confirm:$false}, looks like that works.

The .csv format may present a problem, as the file is generated by an application as i had posted.  I hope not a huge problem for the Apps' guys, but it may make it easier if both the "Add" and "Remove" .csv's are formatted the same way.

Can i include:  $results | export-csv C:\results.txt to export the results to a file?
SubSun

just Add-ADGroupMember -Identity $_.Group -Members $_.Member will work. no need of  -Confirm.

You can modify the script based on csv format however if you have a input file as mentioned above, then things will be much easy..

What result you want to export?
yo_bee

We are looking to remove correct?
Doesn't prompt you Yes, Yes To All, No, No To All?
⚡ FREE TRIAL OFFER
Try out a week of full access for free.
Find out why thousands trust the EE community with their toughest problems.
MD187

ASKER
Thanks Subsun,

I am hopeful that i can have the input file modified, easy is good :)

As to the results, i would like a file that shows the account that were added and/or removed. Not crucial, but would be helpful for the Apps Guys.

Thanks
SubSun

I may go back and change the "add user VB script" to PS.  
Now we are talking about adding.. adding will not prompt..
yo_bee

@MD

That is what it used to be like, but as you can see PS has many one liners Verb Noun processes that make it easier on everyone.
All of life is about relationships, and EE has made a viirtual community a real community. It lifts everyone's boat
William Peck
SubSun

For reporting you can use Try Catch method in PowerShell, do you want to generate a log file or just want to display it in screen?
MD187

ASKER
A log file.
ASKER CERTIFIED SOLUTION
SubSun

THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
⚡ FREE TRIAL OFFER
Try out a week of full access for free.
Find out why thousands trust the EE community with their toughest problems.
MD187

ASKER
Works perfectly, is there a way to overwtie the logfile, instead of append?
⚡ FREE TRIAL OFFER
Try out a week of full access for free.
Find out why thousands trust the EE community with their toughest problems.
SOLUTION
SubSun

THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
⚡ FREE TRIAL OFFER
Try out a week of full access for free.
Find out why thousands trust the EE community with their toughest problems.
yo_bee

$logfile = New-Item "Filepath\name.txt" -Force
MD187

ASKER
Thank you all for the help, errr, doing this for me. I have learned quite a bit and it has helped in understanding why the solutions you both presented work.  At the very least, yet another nail in the VB coffin for me.  

Again, thank you for the expertise in resolving my issue, Happy New Years!
yo_bee

Did you try the New-Item method over the Remove-Item?
Just one less step for the script.
Experts Exchange has (a) saved my job multiple times, (b) saved me hours, days, and even weeks of work, and often (c) makes me look like a superhero! This place is MAGIC!
Walt Forbes
MD187

ASKER
I did, thank you. I tried to give both you guys some points for all the colaberation.  Again thank you!

Take care all!