powershell - Powershell - 从具有 AD 属性的组中删除成员

Question

如果成员在 AD 的employeeNumber 属性中有任何值，我想从组中删除他们。我可以使用 Get-ADGroupMember 返回组的所有成员，但是我如何迭代以删除具有值的成员？

Answer 1

尝试这样的事情来枚举具有属性集的组成员：

Get-ADGroupMember 'groupname' | Get-ADUser -Properties * |
    ? { $_.employeeNumber -ne $null }

要真正从组中删除这些成员，您必须添加第二步，如下所示：

$membersToRemove = Get-ADGroupMember 'groupname' `
  | Get-ADUser -Properties * `
  | ? { $_.employeeNumber -ne $null } `
  | % { $_.sAMAccountName }
Remove-ADGroupMember 'groupname' $membersToRemove

Answer 2

$members = Get-ADGroupMember -Identity group1 | 
Where-Object { (Get-ADUser -Filter {SamAccountName -eq $_.SamAccountName} -Properties EmployeeNumber).EmployeeNumber }

Remove-ADGroupMember -Identity group1 -Members $members -Confirm:$false