I am trying to remove a user in DomainB from a group in DomainA.
So far, I have not been able to do so using powershell.
$Tusr = Get-ADUser TestUser -server DomainB.company.com $grp = Get-ADGroup TestGroup -server DomainA.company.com Remove-ADPrincipalGroupMembership -server DomainA.company.com TestUser -MemberOf $grp
This gives me this error:
WARNING: Could not remove member(s) from ADGroup: 'CN=TestGroup,OU=JD,OU=Temp,DC=uk,DC=Comp,DC=com'. Error is: 'The specified account name is not a member of the group'. Remove-ADPrincipalGroupMembership : Could not remove member(s) to one or more ADGroup. At line:1 char:1+ Remove-ADPrincipalGroupMembership -server DomainA TestUser -MemberOf $grp ...+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+ CategoryInfo : OperationStopped: (Microsoft.Activ...ement.ADGroup[]:ADGroup[]) [Remove-ADPrincipalGroup Membership], ADException+ FullyQualifiedErrorId : 1,Microsoft.ActiveDirectory.Management.Commands.RemoveADPrincipalGroupMembership
If I try to be clever and user Remove-ADGroupMember, I do this:
$usr = Get-ADUser TestUser -server DomainB Remove-ADGroupMember TestGroup -Members $usr -server DomainA
Followed by this error:
Remove-ADGroupMember : The specified account name is not a member of the group At line:1 char:1+ Remove-ADGroupMember TestGroup -Members $usr -server DomainA+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+ CategoryInfo : NotSpecified: (TestGroup:ADGroup) [Remove-ADGroupMember], ADException+ FullyQualifiedErrorId : The specified account name is not a member of the group,Microsoft.ActiveDirectory.Management.Commands.RemoveADGro upMember
I get the same error when running:
Remove-ADGroupMember $grp -Members $usr -server DomainA
So, basically, I'm wondering if PowerShell is bugged out when trying to do cross-domain stuff like this...
I have looked at this post:
Adding/removing members from another forest or domain to groups in Active Directory
But unfortunately, I get the first error I posted.
I will not be able to use Quest, or other thrid party, commandlets.
Any ideas?