从用户列表中删除安全组，不包括少数

Question

PowerShell 初学者在这里....

我需要清理 AD 中包含数千个帐户的已终止用户 OU。我想从每个帐户中删除所有组，除了 2 个特定组（域用户和一个许可组）。

谁能指出我正确的方向来了解这个脚本的外观？我在网上找到了一些示例，但似乎找不到任何解释如何排除组的内容。

我发现了一些可以让我从单个组中删除人员列表的东西.....但我不确定如何将其转换为删除所有组的东西，除了我想要排除的组。

Start-Transcript -Path -Append

# Import the data from CSV file and assign it to variable
$Users = Import-Csv ""

# Specify target group where the users will be removed from
# You can add the distinguishedName of the group. For example: CN=Pilot,OU=Groups,OU=Company,DC=exoip,DC=local
$Group = groupname

foreach ($User in $Users) {
    # Retrieve UPN
    $UPN = $User.UserPrincipalName

    # Retrieve UPN related SamAccountName
    $ADUser = Get-ADUser -Filter "UserPrincipalName -eq '$UPN'" | Select-Object SamAccountName
    
    # User from CSV not in AD
    if ($ADUser -eq $null) {
        Write-Host "$UPN does not exist in AD" -ForegroundColor Red
    }
    else {
        # Retrieve AD user group membership
        $ExistingGroups = Get-ADPrincipalGroupMembership $ADUser.SamAccountName | Select-Object Name

        # User member of group
        if ($ExistingGroups.Name -eq $Group) {

            # Remove user from group
            Remove-ADGroupMember -Identity $Group -Members $ADUser.SamAccountName -Confirm:$false -WhatIf
            Write-Host "Removed $UPN from $Group" -ForeGroundColor Green
        }
        else {
            # User not member of group
            Write-Host "$UPN does not exist in $Group" -ForeGroundColor Yellow
        }
    }
}
Stop-Transcript

Answer 1

使用 PowerShell 从 Azure AD 组中删除大量用户的最快方法是：

使用 Remove-AzADGroupMember 比使用 Remove-MsolGroupMember 更快。

Import-Module AzureAD
$Credential = Get-Credential
Connect-AzureAD -Credential $Credential
$group=Get-AzureADGroup -SearchString 'Your Tenant Group Name' 
$users=Get-AzureADGroupMember -ObjectId $Group.ObjectId -All $true |where {$_.ObjectType -eq 'User'}
foreach($user in $users){
Remove-AzureADGroupMember -ObjectId $Group.ObjectId -MemberId $user.objectId
} 

注意：在凭据提示框中，提供租户的管理员ID和密码。如果组中有很多用户，则预计需要一些时间。

---

需要删除存在于一个或多个组中的用户

如果您是为单个用户执行此操作：

 $user_upn = "<USER UPN>"
 $users= Get-AzureADGroupMember -ObjectId "<GROUP B ID>" -All $true

 #Finds for a specific user and if it exists, goes ahead and remove the specific user from the Group A
 $users |?{$_.UserPrincipalName -eq $user_upn} | %{Remove-AzureADGroupMember -ObjectId "<GROUP A ID>" -MemberId $_.objectid}

说明

获取组 B 的所有成员并将其存储在变量 $users 中。检查（过滤）所需的成员是否存在于 $users 变量中，如果是，则继续并从组 A 中删除。

如果您希望为文件中的 UPN 列表执行此操作。你可以参考下面的sn-p。

 #Getting the list of UPNS of the users for whom the process specified needs to be carried out
 $user_upns = Get-Content "C:\ListUPN.txt"
 
 #Iterates through each UPN
 foreach( $user_upn in $user_upns)
 {
 
 Write-Host "Working on the $user_upn" -ForegroundColor Green
 
 #Gets all user from the GROUP B
 $users= Get-AzureADGroupMember -ObjectId "<GROUP B ID>" -All $true
 
 #Finds for a specific user and if it exists, goes ahead and remove the specific user from the Group A
 $users |?{$_.UserPrincipalName -eq $user_upn} | %{Remove-AzureADGroupMember -ObjectId "<GROUP A ID>" -MemberId $_.objectid}

 }

---

尝试删除多个组中的用户，以便过滤和删除操作变得容易！