Shulou(Shulou.com)06/03 Report--

This requirement can be met in two directions

1. Find the disabled account and delete all groups except domain users. The script reads as follows

#Import AD module

import-module ActiveDirectory

Banned Users

$users = get-aduser -Filter * -SearchBase "OU=xxx,DC=xxx,DC=com" | foreach {if ($.enabled -eq $false){echo $.Name} }

#Delete all user groups

foreach($user in $users){

$Membership = Get-ADPrincipalGroupMembership $User

$group = $Membership.distinguishedName -ne "CN=Domain Users,CN=Users,DC=xxx,DC=com"

Remove-ADPrincipalGroupMembership -identity $User -MemberOf $group -confirm:$False

}

2. Find the samaccountname and group of the disabled account, and delete the members of the group other than domain users through samaccountname. The contents are as follows

import-module ActiveDirectory

$users = get-aduser -filter 'enabled -eq $false' -Properties samaccountname, memberof -SearchBase "OU=xxx,DC=xxx,dc=com" | select samaccountname,

@{ n = 'MemberOf'; e = { ($.memberof | % { (Get-ADObject $).Name }) -join "," } }

Foreach ($user in $users)

{

Get-ADGroup -Filter { name -notlike "domain users" } | Remove-ADGroupMember -Members $user.samaccountname -Confirm:$False

}

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.