Forum Discussion
Removing users from an AD group
Hello,
I am using the following script to remove a batch of users from an AD group:
$x=Get-Content "C:\Users\damien.hartmann\Documents\Comptes.txt"
for ($i=0; $i -lt $x.Count; $i++)
{
Remove-ADGroupMember -Identity 'Office365_LicenceE1_Base' -Members $x[$i]
}However I get the following error:
Remove-ADGroupMember : Impossible de lier le paramètre «Members». Impossible de convertir la valeur «C» en type «Microsoft.ActiveDirectory.Management.ADPrincipal». Erreur: «Cast non valide
de 'System.Char' en 'Microsoft.ActiveDirectory.Management.ADPrincipal'.»
Au caractère C:\Users\damien.hartmann\Documents\changer_comptes_v3.ps1:4 : 68
+ ... ve-ADGroupMember -Identity 'Office365_LicenceE1_Base' -Members $x[$i]
+ ~~~~~~
+ CategoryInfo : InvalidArgument : (:) [Remove-ADGroupMember], ParameterBindingException
+ FullyQualifiedErrorId : CannotConvertArgumentNoMessage,Microsoft.ActiveDirectory.Management.Commands.RemoveADGroupMember(apologies for the French)
The "C" mentioned is the first character of the first user in the Comptes.txt file.
Do you see where I made a mistake?
Thanks!
Yes and no.
In principle, it could be made to work that way but there's two points I'd make:
- To get that specific type conversion error from your original post, there's something wrong with your input file, since the entire file is considered to be one single string;
- Even if the input file were correctly interpreted as a string array, using a "for" loop is very inefficient and won't scale well.
Strictly-speaking, the "for" loop is entirely unnecessary if the input file contains any of the four string references (the most likely string formats to be chosen being either sAMAccountName or distinguishedName).
If the issue with the input file can be fixed, then the simplest and most efficient way to remove the members contained within the input file would be:
Example
Remove-ADGroupMember -Identity "Office365_LicenceE1_Base" -Members (Get-Content -Path "C:\Users\damien.hartmann\Documents\Comptes.txt") -Confirm:$false;Imagine your input file had 1,000 users in it at one user per line. Using a "for" loop approach would result in 1,000 separate calls to Active Directory for the setting of the group's "member" attribute.
Using the example above, a single call is made to Active Directory when setting the group's "member" attribute. That's a considerable difference and why there's a tremendous impact on Active Directory when using a loop.
Cheers,
Lain
7 Replies
There's multiple ways of tackling this, with some being significantly more efficient than others.
But first, what does your input file (Comptes.txt) contain?
If it contains RFC822 (or SMTP-style, if you prefer, as used for mail and userPrincipalName) addresses, this will not work. As per the documentation, only a specific set of string types can be used and SMTP-style addresses:
Accepted attribute formats for strings are:
- distinguishedName
- objectGUID
- objectSid
- sAMAccountName
You could take SMTP-style addresses from your Comptes.txt file, look up the users to obtain ADPrincipal objects, and then pass those to Remove-ADGroupMember, but this is a wildly inefficient path to pursue if you have more than, say, a few dozen users.
Cheers,
Lain
- Thank you for the feedback Lain.
In my comptes.txt file I have users in firstname.name format, each on a separate line.
I will indeed have hundreds of users to manipulate, and cannot search the individual DistinguishedName for each of them.Does firstName.surname match the sAMAccountName naming standard?
If it doesn't match sAMAccountName then it's not going to work, as it's not one of the four supported string standards listed above.
Cheers,
Lain
