Sunday, November 15, 2015

Get-ADPrincipleGroupMembership - lists the groups that a user, computer or group is a member of.



While this command can be used to obtain the list of groups a user  or a group is a member of, it will not do recursion i.e. it will not list the groups a user is in as a result of groups.

Get-ADPrincipalGroupMembership -Identity <userORgroupORComputer> | Select-Object -ExpandProperty SamAccountName | Sort-Object SamAccountName

in the above command place a where filter before select object cmdlet to narrow the results. 

https://technet.microsoft.com/en-us/library/ee617259.aspx 

This script removes an account from all groups with a name matching a string.  Note that the confirmation has been knocked out! Be careful.

 $AccountDN = "CN=MACHINENAME,OU=xxx,OU=xxx,OU=xxx,OU=xxx,OU=XXX,DC=xxx,DC=xxx,DC=xxx"
$grouplist = Get-ADPrincipalGroupMembership -id $AccountDN | where {$_.name -like "*string*"} | select -expand name

echo $grouplist

$ConfirmPreference = "none"

ForEach ($group in $grouplist)

{
echo $group
Remove-ADPrincipalGroupMembership -id $AccountDN -MemberOf $group
}