Quantcast
Channel: Windows PowerShell forum
Viewing all articles
Browse latest Browse all 21975

Removing user in DomainB from a group in DomainA

$
0
0

I am trying to remove a user in DomainB from a group in DomainA.

So far, I have not been able to do so using powershell.

$Tusr = Get-ADUser TestUser -server DomainB.company.com
$grp = Get-ADGroup TestGroup -server DomainA.company.com
Remove-ADPrincipalGroupMembership -server DomainA.company.com TestUser -MemberOf $grp

This gives me this error:

WARNING: Could not remove member(s) from ADGroup: 'CN=TestGroup,OU=JD,OU=Temp,DC=uk,DC=Comp,DC=com'. Error is:
'The specified account name is not a member of the group'.
Remove-ADPrincipalGroupMembership : Could not remove member(s) to one or more ADGroup.
At line:1 char:1+ Remove-ADPrincipalGroupMembership -server DomainA TestUser -MemberOf $grp ...+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+ CategoryInfo          : OperationStopped: (Microsoft.Activ...ement.ADGroup[]:ADGroup[]) [Remove-ADPrincipalGroup
   Membership], ADException+ FullyQualifiedErrorId : 1,Microsoft.ActiveDirectory.Management.Commands.RemoveADPrincipalGroupMembership

If I try to be clever and user Remove-ADGroupMember, I do this:

$usr = Get-ADUser TestUser -server DomainB
Remove-ADGroupMember TestGroup -Members $usr -server DomainA

Followed by this error:

Remove-ADGroupMember : The specified account name is not a member of the group
At line:1 char:1+ Remove-ADGroupMember TestGroup -Members $usr -server DomainA+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+ CategoryInfo          : NotSpecified: (TestGroup:ADGroup) [Remove-ADGroupMember], ADException+ FullyQualifiedErrorId : The specified account name is not a member of the group,Microsoft.ActiveDirectory.Management.Commands.RemoveADGro
   upMember

I get the same error when running:

Remove-ADGroupMember $grp -Members $usr -server DomainA

So, basically, I'm wondering if PowerShell is bugged out when trying to do cross-domain stuff like this...

I have looked at this post:

Adding/removing members from another forest or domain to groups in Active Directory

But unfortunately, I get the first error I posted.

I will not be able to use Quest, or other thrid party, commandlets.

Any ideas?


Viewing all articles
Browse latest Browse all 21975

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>