Function to remove all AD groups from user excluding 1 particular group


we have long script use user termination process.  1 of functions in script finds , removes groups account member of.  have had request if member of 1 particular group, 1 group not removed.  seems should simple accomplish.

i have tried many variations , every time removes group others.

here sample script removes groups works.:

function removegroupsfromuser([string]$username)    {    	$userobj = get-qaduser -identity $username    	foreach ($grp in $userobj.memberof)    	{    		try     		{     			$null = remove-qadgroupmember -identity $grp -member $username -erroraction silentlycontinue    		 }    		catch     		{    			$errormessage = $_.exception.message    			$groupname = $grp.name    			logmessage -user $username -message "failed remove user group: $groupname"    			write-output "failed remove $username $grpname"    		 }    	}    }


this have tried:

attempt1 - removed groups including 1 don't want removed.:

function removegroupsfromuser([string]$username)      {    $userobj = get-qaduser -identity $username    foreach ($grp in $userobj.memberof | {$_.name -ne "adm_oracle-hyperion"})    	{            	try                    {                    $null = remove-qadgroupmember -identity $grp -member $username -erroraction silentlycontinue                    }                    catch                    {                    $errormessage = $_.exception.message                    $groupname = $grp.name                    logmessage -user $username -message "failed remove user group: $groupname"                    write-output "failed remove $username $grpname"                    }               }    }


attempt 2 removed groups including 1 don't want removed.:

function removegroupsfromuser([string]$username)    {            $userobj = get-qaduser -identity $username            foreach ($grp in $userobj.memberof)        		{                    try                    {                    if ($grp.name -eq "adm_oracle-hyperion")    			{                		}                	else {                		$null = remove-qadgroupmember -identity $grp -member $username -erroraction silentlycontinue                		}                    }                    catch                    	{                            $errormessage = $_.exception.message                            $groupname = $grp.name                            logmessage -user $username -message "failed remove user group: $groupname"                            write-output "failed remove $username $grpname"                    	}                 }    }  

any suggestions how can work?

heres how function using script like
function terminate-user {      [cmdletbinding()]     param(         [parameter(mandatory=$true)]         [string]$username         )          get-aduser -identity $username -properties memberof | select -expandproperty memberof | foreach-object {         $oracle_group = 'cn=oracle,dc=mydomain,dc=local'         if ( ! ($_ -match $oracle_group)) {         write-output "removing $username group $_"         remove-adgroupmember -identity $_ -members $username -verbose          write-output "user terminated" }                                     }                               }



Windows Server  >  Windows PowerShell



Comments

Popular posts from this blog

2008 Windows Deployment Server Properties Error

Can no longer user MS Update - Files required to use Microsoft Update are no longer registered

How do a find data in one file, search for it in another file and if not found, write a custom message to another file