Rabbi Bob: /* Code */ Yikes, had Doman Users in the remove, should fail, but oof

2019-05-24T14:06:52Z

Code: Yikes, had Doman Users in the remove, should fail, but oof

← Older revision		Revision as of 14:06, 24 May 2019
Line 50:		Line 50:
	Get-ADGroup -LDAPFilter "(member=$UserDN)" \| foreach-object {		Get-ADGroup -LDAPFilter "(member=$UserDN)" \| foreach-object {
	#if ($_.name -notin "Domain Users","RandomSecGrp") #EXCLUSION - slightly more dangerous		#if ($_.name -notin "Domain Users","RandomSecGrp") #EXCLUSION - slightly more dangerous
	if ($_.name -in ~~"Domain Users",~~"RandomSecGrp","AnotherRandomSecGrp","YARSG","WeGetIt_AnotherSecGrp")		if ($_.name -in "RandomSecGrp","AnotherRandomSecGrp","YARSG","WeGetIt_AnotherSecGrp")
	{		{
	$Group=$_.name		$Group=$_.name

Rabbi Bob: Created page with "=Purpose= This script was an extension of Powershell: AD Group Membership from OU and is quite dangerous. It will run through the designated OU and remove any security gr..."

2019-05-23T20:22:31Z

Created page with "=Purpose= This script was an extension of Powershell: AD Group Membership from OU and is quite dangerous. It will run through the designated OU and remove any security gr..."

New page

=Purpose=
This script was an extension of [[Powershell: AD Group Membership from OU]] and is quite dangerous. It will run through the designated OU and remove any security groups designated (or you can give it a list to ignore, which is even more dangerous if you the list is empty). Has very basic logging to csv so you could rebuild if you had to.

==To Do==
* build in a failsafe check ala DO YOU REALLY WANT TO DO THIS?
* build in a check for OUs never to run against (allow a list of OU's to be programmed that you couldn't run this against)
* figure out a variable check for Test vs Nuke vs Confirm (maybe default to Test)
* learn how to read in from a list into an array for a .ignore list (or .nuke list)

=Code=
<pre>
##################################################
## Remove Groups from Users found in target $OU ##
##################################################
## To Do
## - Build Output to Log [Done]
## - Add Flag for Test vs Nuke vs Confirm
## - Warning and Confirmation
##################################################
## Test
## - Multiple -ne in If
## - Array of Groups to ignore
##################################################
# Research: powershell pass variable to parameter
# https://stackoverflow.com/questions/46121939/passing-a-powershell-variable-as-a-cmdlet-parameter
##################################################
###################################################
## User Variables

#$OU = "OU=,OU=,OU=,OU=,DC=rabbibob,DC=com"
$OU = "OU=Users,DC=rabbibob,DC=com"
####################################################

## Logging Setup
$Logfile = "AD_RemoveGroups_CleanUp_20190523.log"
Function LogWrite
{
Param ([string]$logstring)

Add-content $Logfile -value $logstring
}

# Start

$GetOU = Get-ADUser -SearchBase $OU -Filter *
foreach ($user in $GetOU)
{
$UserDN = $user.DistinguishedName
$Name=$user.SamAccountName
Get-ADGroup -LDAPFilter "(member=$UserDN)" | foreach-object {
#if ($_.name -notin "Domain Users","RandomSecGrp") #EXCLUSION - slightly more dangerous
if ($_.name -in "Domain Users","RandomSecGrp","AnotherRandomSecGrp","YARSG","WeGetIt_AnotherSecGrp")
{
$Group=$_.name
$LogLine = $Name+","+$Group
LogWrite $LogLine
write-host "$Name - $Group"
### RUN WITHOUT CONFIRMATION
remove-adgroupmember -identity $Group -member $UserDN
### RUN WITH CONFIRMATION
#remove-adgroupmember -identity $Group -member $UserDN -Confirm:$False
}
}
}

</pre>
[[Category:Powershell]]
[[Category:Weblog-2019-05]]

Powershell: Remove AD Group Memberships from OU - Revision history

Rabbi Bob: /* Code */ Yikes, had Doman Users in the remove, should fail, but oof

Rabbi Bob: Created page with "=Purpose= This script was an extension of Powershell: AD Group Membership from OU and is quite dangerous. It will run through the designated OU and remove any security gr..."