Function to remove all AD groups from user excluding 1 particular group
we have long script use user termination process. 1 of functions in script finds , removes groups account member of. have had request if member of 1 particular group, 1 group not removed. seems should simple accomplish.
i have tried many variations , every time removes group others.
here sample script removes groups works.:
function removegroupsfromuser([string]$username) { $userobj = get-qaduser -identity $username foreach ($grp in $userobj.memberof) { try { $null = remove-qadgroupmember -identity $grp -member $username -erroraction silentlycontinue } catch { $errormessage = $_.exception.message $groupname = $grp.name logmessage -user $username -message "failed remove user group: $groupname" write-output "failed remove $username $grpname" } } }
this have tried:
attempt1 - removed groups including 1 don't want removed.:
function removegroupsfromuser([string]$username) { $userobj = get-qaduser -identity $username foreach ($grp in $userobj.memberof | {$_.name -ne "adm_oracle-hyperion"}) { try { $null = remove-qadgroupmember -identity $grp -member $username -erroraction silentlycontinue } catch { $errormessage = $_.exception.message $groupname = $grp.name logmessage -user $username -message "failed remove user group: $groupname" write-output "failed remove $username $grpname" } } }
attempt 2 removed groups including 1 don't want removed.:
function removegroupsfromuser([string]$username) { $userobj = get-qaduser -identity $username foreach ($grp in $userobj.memberof) { try { if ($grp.name -eq "adm_oracle-hyperion") { } else { $null = remove-qadgroupmember -identity $grp -member $username -erroraction silentlycontinue } } catch { $errormessage = $_.exception.message $groupname = $grp.name logmessage -user $username -message "failed remove user group: $groupname" write-output "failed remove $username $grpname" } } } any suggestions how can work?
function terminate-user { [cmdletbinding()] param( [parameter(mandatory=$true)] [string]$username ) get-aduser -identity $username -properties memberof | select -expandproperty memberof | foreach-object { $oracle_group = 'cn=oracle,dc=mydomain,dc=local' if ( ! ($_ -match $oracle_group)) { write-output "removing $username group $_" remove-adgroupmember -identity $_ -members $username -verbose write-output "user terminated" } } }
Windows Server > Windows PowerShell
Comments
Post a Comment