{"id":66483,"date":"2006-09-13T16:24:00","date_gmt":"2006-09-13T16:24:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2006\/09\/13\/how-can-i-delete-all-the-users-in-an-active-directory-group\/"},"modified":"2006-09-13T16:24:00","modified_gmt":"2006-09-13T16:24:00","slug":"how-can-i-delete-all-the-users-in-an-active-directory-group","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/how-can-i-delete-all-the-users-in-an-active-directory-group\/","title":{"rendered":"How Can I Delete All the Users in an Active Directory Group?"},"content":{"rendered":"

\"Hey, \n

Hey, Scripting Guy! How can I delete all the users in an Active Directory group?

— AA<\/P>\"Spacer\"\"Hey,\"Script<\/A> \n

Hey, AA. You know, that\u2019s something we Scripting Guys never thought about: a script that could eliminate all the users in a particular group. The only problem we have with that is: where do we start? For example, maybe we start with the teenagers a few houses down, the same group that occasionally gets the uncontrollable urge to go outside and skateboard at 3:00 in the morning. (Although, to be fair, who among us doesn\u2019t<\/I> occasionally get the uncontrollable urge to skateboard at 3:00 in the morning?) Or maybe we start with that group of baseball players, the ones who clapped their hands, waved their arms, and yelled at the pitcher as he prepared to pitch. (Too bad the Scripting Son didn\u2019t pitch that game; he<\/I> would have known exactly what to do with that group.) <\/P>\n

And then there\u2019s all those groups here at work, like the one where all the people \u2013 What\u2019s that? All you want to do is remove the group memberships for all the users in a specified Active Directory group? Oh, sure, no problem; we can do that. <\/P>\n

What were we<\/I> thinking about? Um, pretty much the same thing, deleting the group memberships for all the users in a specified Active Directory group.<\/P>\n

Pretty much.<\/P>\n

As it turns out, if all you want to do is delete a few Active Directory group memberships, well, that can be done using a script no more complicated than this:<\/P>

Const ADS_PROPERTY_CLEAR = 1 <\/p>\n
Set objGroup = GetObject(“LDAP:\/\/cn=Finance Users,ou=Finance,dc=fabrikam,dc=com”) <\/p>\n
objGroup.PutEx ADS_PROPERTY_CLEAR, “member”, 0\nobjGroup.SetInfo\n<\/PRE>\n
We agree: if only deleting other kinds of groups was that easy! As you can see, we start out by defining a constant named ADS_PROPERTY_CLEAR and setting the value to 1; we\u2019ll use this constant to tell the script that we want to clear all the values of the group\u2019s Member<\/B> attribute. (Needless to say, the Member attribute is a multi-valued attribute that contains the list of group members.) After defining the constant we then use this line of code to connect to the group in question, in this case the Finance Users group located in fabrikam.com\u2019s Finance OU:<\/P>
Set objGroup = GetObject(“LDAP:\/\/cn=Finance Users,ou=Finance,dc=fabrikam,dc=com”) \n<\/PRE>\n
Amazingly enough, we\u2019re halfway done at this point. After binding to the group account we use the PutEx<\/B> method to actually clear the group membership. (The PutEx method is an ADSI method designed to work with multi-valued attributes, attributes that can contain multiple values, like multiple user names.) We need to pass PutEx three parameters:<\/P>\n\n\n\n\n\n
\u2022<\/TD>\n\n
ADS_PROPERTY_CLEAR<\/B>, the constant that tells PutEx we want to delete all the values in the specified attribute. Other constants<\/B><\/A> \u2013 and their corresponding values \u2013 would enable us to do things like add new members to the group or delete specified members from the group.<\/P><\/TD><\/TR>\n
\u2022<\/TD>\n\n
Member<\/B>, the multi-valued attribute we want to clear.<\/P><\/TD><\/TR>\n
\u2022<\/TD>\n\n
0<\/B>, the new value being assigned to the attribute. Technically it doesn\u2019t matter what<\/I> value we specify here: when you perform an operation using ADS_PROPERTY_CLEAR ADSI ignores this third parameter. However, if you leave the parameter out you\u2019ll get a \u201cWrong number of arguments\u201d error. We put a 0 here simply as a reminder that, when the script finishes, the Finance Users group will have 0 members.<\/P><\/TD><\/TR><\/TBODY><\/TABLE>\n
After calling the PutEx method we\u2019re left with just one final task: we need to call the SetInfo<\/B> method to write these changes (i.e., delete all the group memberships) back to Active Directory. That\u2019s what we do with this line of code:<\/P>
objGroup.SetInfo\n<\/PRE>\n
Execute that last line and, just like that, all the members of the Finance Users group will be deleted.<\/P>\n
Now, if we could just remove all the members of the people-who-honk-their-horns-before-the-light-even-turns-green group, well, then we\u2019d really be on to something, wouldn\u2019t we?<\/P><\/p>\n","protected":false},"excerpt":{"rendered":"
Hey, Scripting Guy! How can I delete all the users in an Active Directory group?— AA Hey, AA. You know, that\u2019s something we Scripting Guys never thought about: a script that could eliminate all the users in a particular group. The only problem we have with that is: where do we start? For example, maybe […]<\/p>\n","protected":false},"author":595,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[7,44,3,198,5],"class_list":["post-66483","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-active-directory","tag-groups","tag-scripting-guy","tag-users","tag-vbscript"],"acf":[],"blog_post_summary":"
Hey, Scripting Guy! How can I delete all the users in an Active Directory group?— AA Hey, AA. You know, that\u2019s something we Scripting Guys never thought about: a script that could eliminate all the users in a particular group. The only problem we have with that is: where do we start? For example, maybe […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/66483","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=66483"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/66483\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=66483"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=66483"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=66483"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}