Re: How to delete an useraccount from a local group using a VBScript

Tech-Archive recommends: Fix windows errors by optimizing your registry

From: Richard Mueller [MVP] (rlmueller-NOSPAM_at_ameritech.NOSPAM.net)
Date: 04/06/04 

Date: Tue, 6 Apr 2004 00:05:38 -0500

Danny D wrote:

> Hope someone can help me with the following problem:
>
> I want to delete an user-account from a local group.
> But it's possible that there is a local group, with two accounts which
> have the same username and a different domain.
>
> i.e.
> Domain_X\user_1
> Domain_Y\user_1
>
> One of them has to be deleted.
> I've tried the following VBScript:
>
>
============================================================================
=
> Set DomainObj = GetObject("WinNT://" & strDomain)
> DomainObj.Filter = Array("Group")
>
> For Each GroupObj In DomainObj
>
> If GroupObj.Class = "Group" Then
> List = ""
>
> For Each UserObj in GroupObj.Members
> If UserObj.Class = "User" Then
> List = List & UserObj.Name & VbCrLf
> End If
> Next
>
>
> WScript.Echo GroupObj.Name & ": " & VbCrLf & VbCrLf & List
>
> End If
>
> Next
>
============================================================================
=
>
> But then I only get a list with username's, without the matching
> domain.
> How do I get the domain so I can delete the correct user??
>
> Who has the correct answer?? Please help me!

Hi,

The best way to delete a user from the group is to bind to both the group
and the user. The binding string includes the domain, so there is no
question which user you refer to. Then, use the Delete method of the group
object and pass the Adspath of the user to the method. For example:

Set objGroup = GetObject("WinNT://Domain/Mygroup,group")
Set objUser = GetObject("WinNT://Domain_X/user_1,user")

If objGroup.IsMember(objUser.AdsPath) Then
  objGroup.Delete(objUser.AdsPath)
End If

Note that I delete the user from the group only if they are a member of the
group. I use the IsMember method of the group object to determine this,
which again takes the AdsPath of the user as a parameter.

Also, your code to enumerate the group members can reveal the domain
information if you output the AdsPath rather than Name. For example:

For Each UserObj In GroupObj.Member
  If UserObj.Class = "User" Then
    List = List & UserObj.AdsPath & vbCrLf
  End If
Next

The AdsPath will be similar to "WinNT://Domain_X/user_1". I hope this helps. 

-- 
Richard
Microsoft MVP Scripting and ADSI
HilltopLab web site - http://www.rlmueller.net
--

Relevant Pages

  • Re: error checking
    ... to add the current user to a local group: ... ' Bind to domain user object with WinNT provider. ... ' Bind to local group object. ... ' Check if user already a member. ...
    (microsoft.public.windows.server.scripting)
  • Re: Add domain user to local group script troubleshoot
    ... > Active Directory pathname was passed ... another way to add a domain user to a local group? ... The local group object's Add method does not understand an LDAP AdsPath. ...
    (microsoft.public.windows.server.scripting)