Adventures in Powershell. These posts have been created as a record of the successful powershell commands I have used.
Sunday, November 15, 2015
Get-ADPrincipleGroupMembership - lists the groups that a user, computer or group is a member of.
While this command can be used to obtain the list of groups a user or a group is a member of, it will not do recursion i.e. it will not list the groups a user is in as a result of groups.
Get-ADPrincipalGroupMembership -Identity <userORgroupORComputer> | Select-Object -ExpandProperty SamAccountName | Sort-Object SamAccountName
in the above command place a where filter before select object cmdlet to narrow the results.
https://technet.microsoft.com/en-us/library/ee617259.aspx
This script removes an account from all groups with a name matching a string. Note that the confirmation has been knocked out! Be careful.
$AccountDN = "CN=MACHINENAME,OU=xxx,OU=xxx,OU=xxx,OU=xxx,OU=XXX,DC=xxx,DC=xxx,DC=xxx"
$grouplist = Get-ADPrincipalGroupMembership -id $AccountDN | where {$_.name -like "*string*"} | select -expand name
echo $grouplist
$ConfirmPreference = "none"
ForEach ($group in $grouplist)
{
echo $group
Remove-ADPrincipalGroupMembership -id $AccountDN -MemberOf $group
}