Using GUID to Remove member from AD Group.

spiceuser-ldus · 2019-06-17T20:08:26.000Z

I saw many examples that allows removal of members from AD Group however, after going through the documentation on Microsoft community I came to know that ObjectGUID is also usable for performing the same operations. I have the GUID of Group & GUID of different members(that I want to remove) how do I perform operation in power shell script?

I tried doing this but it didn’t work.

$GroupGUID = 'a3d65150-1739-4cc7-80d2-7b97c76b0aff'
Get-ADGroupMember -Identity $GroupGUID |
    Where-Object {$_.ObjectGUID -eq '8a3fab53-4c8b-483d-89f0-e26de236a627'} |
    ForEach-Object {Remove-ADGroupMember $GroupGUID $_ -Confirm:$false}

Is it suppose to work both the GroupGUID & ObjectGUID are unique for Ad Groups & AD Users in the Active Directory Domain.

Neally · 2019-06-17T20:11:04.000Z

If you post code, please use the ‘Insert Code’ button. Please and thank you!

PLEASE READ BEFORE POSTING! Read if you're new to the PowerShell forum! Programming & Development

Hi, and welcome to the PowerShell forum! Don’t apologize for being a “noob” or “newbie” or “n00b.” There’s just no need – nobody will think you’re stupid, and the forums are all about asking questions. Just ask! Use a descriptive subject. Don't say "Need help" or "PowerShell Help", actually summarize what the problem is. It helps the rest of us keep track of which problem is which. Don’t post massive scripts. We’re all volunteers and we don’t have time to read all that, nor will we copy, past…

Neally · 2019-06-17T20:18:32.000Z

that seems overly complicated

Remove-ADGroupMember -Identity $GroupGUID -Members $UserGUID -Confirm:$false

Neally · 2019-06-17T20:21:46.000Z

spiceuser-ldus:

are unique for Ad Groups & AD Users in the Active Directory Domain

Yes, the same group in a different domain has most likely a different GUID.

DoctorDNS · 2019-06-18T06:42:37.000Z

I see the code - but what is the issue?

troberts2 · 2019-06-18T10:55:51.000Z

Not sure why you are using GUID when you can just use the user ID which has to be unique anyway.
Where we are we have some employees that are seasonal and then others that leave and come back so we don’t remove, just “terminate “ by removing all groups and putting into an OU which has zero logon access privileges.
I posted the script on here before with a how to and instructions on how to tweak for your own environment. Plus it also documents what groups etc they were in so you can save into a ticket for reference later too:

automate AD termination

Part of the code includes enumerating and removing from groups. Not sure what you are trying to accomplish in the long run but maybe this will help? Maybe elaborate on what you are trying to do?