Remove Multiple Specific Users from Multiple Groups

victorflorencio · 2018-06-18T19:49:58.000Z

Good Night Everyone.

I’m trying to remove specific users from a multiple different groups, but I couldnt do it yet.

Here’s the scenario that I have:

One CSV with 2 colums - Groups and Users

I need a script that reads my CSV file and remove the users from the groups based on that.

The script below doesnt fit to me.

Can someone help me, please?

Thanks!

$users = import-csv “C:\Victor\File.csv”
$groups = Get-ADGroup -Filter {Name -like “g-admin-***”} |select -ExpandProperty name
Foreach ($group in $groups) {
Foreach ($user in $users) {
Try{
#Set-ADUser $user.samaccountname -Description “Was member of $group”
Remove-ADPrincipalGroupMembership $user.samaccountname -member $group -confirm:$false -ErrorAction Stop
Write-Host “removing $($user.samaccountname) from $group” -ForegroundColor green
Write-Output "User $($user.samaccountname) removed from $group " |Out-File “c:\dinamio\victorlogfile.txt” -Append
}

Catch
{write-warning “$_ Error removing user $($User.samaccountname)”}
}

Neally · 2018-06-18T19:51:32.000Z

Welcome!

If you post code, please use the ‘Insert Code’ button. Please and thank you!

PLEASE READ BEFORE POSTING! Read if you're new to the PowerShell forum! Programming & Development

Hi, and welcome to the PowerShell forum! Don’t apologize for being a “noob” or “newbie” or “n00b.” There’s just no need – nobody will think you’re stupid, and the forums are all about asking questions. Just ask! Use a descriptive subject. Don't say "Need help" or "PowerShell Help", actually summarize what the problem is. It helps the rest of us keep track of which problem is which. Don’t post massive scripts. We’re all volunteers and we don’t have time to read all that, nor will we copy, past…

Neally · 2018-06-18T19:58:46.000Z

I am not sure I am understanding you correctly.

You want every user removed from every group listed in the CSV?

$csv = import-csv "C:\Victor\File.csv"

foreach($user in $csv.users){
    foreach($group in $csv.groups){
        try{
            Remove-ADPrincipalGroupMembership $user -member $group -confirm:$false -ErrorAction Stop -verbose
            Write-Output "User '$user' removed from '$group'" |
            Out-File "c:\dinamio\victorlogfile.txt" -Append
        }
        catch{
            write-warning "Error removing user '$User' fron '$group'"
        }
    }
}

victorflorencio · 2018-06-18T20:09:49.000Z

Neally,

Thank you!

Basically yes, I want to Remove the specific user from column USER from the specific group on column GROUP.

victorflorencio · 2018-06-18T20:13:29.000Z

Note, there are other users in those groups listed in CSV, but I want to remove only the users that are in the CSV.

Neally · 2018-06-18T20:15:50.000Z

victorflorencio:

Note, there are other users in those groups listed in CSV, but I want to remove only the users that are in the CSV.

ok…?

How about you add a '-whatif; parameter to the script I gave you and run it and see if it gives you the desired result?

victorflorencio · 2018-06-18T21:23:16.000Z

Thanks Neally, i’m already trying.

But, I’ve got a problem to run the script, with the variable $csv before de importation, the error is

import-csv : Could not find file ‘C:\temp\RemoveADUsersFromGroup4.csv’.
At C:\temp\RemoveDUser.ps1:1 char:8

$csv = import-csv C:\temp\RemoveADUsersFromGroup4.csv
CategoryInfo : OpenError: ( [Import-Csv], FileNotFoundException
FullyQualifiedErrorId : FileOpenFailure,Microsoft.PowerShell.Commands.ImportCsvCommand

}
}

Its strange because the file is there in the path… The parameter runs only if I remove the CSV variable.

Any sugestion?

$csv = import-csv C:\temp\RemoveADUsersFromGroup4.csv

foreach($user in $csv.users){
    foreach($group in $csv.groups){
        try{
            Remove-ADPrincipalGroupMembership $user -member $group -confirm:$false -ErrorAction Stop -verbose
            Write-Output "User '$user' removed from '$group'" |
            Out-File "c:\temp\victorlogfile.txt" -Append
        }
        catch{
            write-warning "Error removing user '$User' from '$group'"
        }
    }
}

Neally · 2018-06-18T21:28:36.000Z

powershell is pretty good with error messages

import-csv : Could not find file 'C:\temp\RemoveADUsersFromGroup4.csv'.

yeah that means either the powershell session has no access to that folder or the file is not there. Do you run powershell as admin (rightclick → run as admin) ? Double check it’s the right directory and spelled correctly.

Also try to put it in quotes

$filepath = "C:\temp\RemoveADUsersFromGroup4.csv"

if (test-path $filepath) {
    $csv = import-csv $filepath
}
else {
    Write-Warning "File not found"
}

foreach ($user in $csv.users) {
    foreach ($group in $csv.groups) {
        try {
            Remove-ADPrincipalGroupMembership $user -member $group -confirm:$false -ErrorAction Stop -verbose -WhatIf
            Write-Output "User '$user' removed from '$group'" |
                Out-File "c:\temp\victorlogfile.txt" -Append
        }
        catch {
            write-warning "Error removing user '$User' from '$group'"
        }
    }
}

victorflorencio · 2018-06-18T22:08:52.000Z

The script passed through CSV importation!

I think the problem now is inside my CSV…

WARNING: Error removing user ‘’ from ‘’
WARNING: Error removing user ‘’ from ‘’
WARNING: Error removing user ‘’ from ‘’
WARNING: Error removing user ‘’ from ‘’

Neally · 2018-06-18T22:13:54.000Z

type in this:

then we see what the last error was

catch {
            write-warning "Error removing user '$User' from '$group'"
write-output $error[0]
        }

$error[0]

victorflorencio · 2018-06-18T22:24:10.000Z

Look:

WARNING: Error removing user ‘’ from ‘’
Remove-ADPrincipalGroupMembership : Cannot validate argument on parameter ‘Identity’. The argument is null. Provide a valid value for the argument, and then try running
the command again.
At line:13 char:47

Remove-ADPrincipalGroupMembership $user -member $group -c …
CategoryInfo : InvalidData: ( [Remove-ADPrincipalGroupMembership], ParameterBindingValidationException
FullyQualifiedErrorId : ParameterArgumentValidationError,Microsoft.ActiveDirectory.Management.Commands.RemoveADPrincipalGroupMembership

Neally · 2018-06-18T23:00:21.000Z

yeah looks like it’s not reading your CSV

$filepath = "C:\temp\RemoveADUsersFromGroup4.csv"
$csv = import-csv $filepath
$csv

does that do anything?

victorflorencio · 2018-06-18T23:22:29.000Z

Neally,

Same error

Remove-ADPrincipalGroupMembership : Cannot validate argument on parameter ‘Identity’. The argument is null. Provide a valid value for the argument, and then try running
the command again.
At line:16 char:47

Remove-ADPrincipalGroupMembership $user -member $group -c …
CategoryInfo : InvalidData: ( [Remove-ADPrincipalGroupMembership], ParameterBindingValidationException
FullyQualifiedErrorId : ParameterArgumentValidationError,Microsoft.ActiveDirectory.Management.Commands.RemoveADPrincipalGroupMembership

Remove-ADPrincipalGroupMembership : Cannot validate argument on parameter ‘Identity’. The argument is null. Provide a valid value for the argument, and then try running
the command again.
At line:16 char:47

Neally · 2018-06-18T23:23:41.000Z

No, literally just run this. we cant to see if it read the CSV

$filepath = "C:\temp\RemoveADUsersFromGroup4.csv"
$csv = import-csv $filepath
$csv

victorflorencio · 2018-06-18T23:35:55.000Z

Oh alright.

It seems ok:

$csv = import-csv $filepath
$csv
import-csv : Could not find file ‘C:\temp\RemoveADUsersFromGroup4.csv’.
At line:2 char:8

$csv = import-csv $filepath
CategoryInfo : OpenError: ( [Import-Csv], FileNotFoundException
FullyQualifiedErrorId : FileOpenFailure,Microsoft.PowerShell.Commands.ImportCsvCommand

Group;User

g-admin-SERVER;user1
g-admin-SERVER;user2
g-admin-SERVER;user3
g-admin-SERVER;user4
g-admin-SERVER;user5

Output.png717×286 8.36 KB

Neally · 2018-06-18T23:40:11.000Z

it looks like your CSV is not a CSV.

CSV stands for comma separated values.

"Group","User"                                  
"g-admin-SERVER","user1"
"g-admin-SERVER","user2"
"g-admin-SERVER","user3"
"g-admin-SERVER","user4"
"g-admin-SERVER","user5"

^ this is what your source CSV should look like

Neally · 2018-06-18T23:41:23.000Z

Also it still says it can not find the file, so you have to make sure that error does not display.

victorflorencio · 2018-06-19T00:52:18.000Z

I transformed my CSV in the format that you sugested. The script runs without error, but, the users are still in the group…

Any other sugestion? Is there another way that I can do that? I have almost 1083 users to remove from specific groups

victorflorencio · 2018-06-19T00:59:37.000Z

I had another idea but not figured out yet how to do it.

All the groups names start with “g-admin-SERVERNAME”.

I could just import all the users, do the search of all groups that starts with “g-admin” and remove the users from my list.

It its possible?

jitensh · 2018-06-19T02:55:31.000Z

HMMM I was feeling like where did I see the script. Oh its mine

https://community.spiceworks.com/scripts/show/4129-remove-multiple-users-from-multiple-groups

M sure the issue is with csv