Remove disabled accounts from groups

Question

Hello,

We want users to be removed from critical groups when account is disabled. Is it possible to do this with Adaxes?

Answer 1

You can do this easily. You need to create a Business Rule that will be triggered after disabling user accounts. This Business Rule will automatically remove disabled users from the groups you specify.

For more details, please see Add Users to a Specific Group When They are Disabled.

Alternatively, if you want to remove disabled users from all groups except the primary group (Domain Users), you can add Run a program or PowerShell script action to your Business Rule that will execute the following PowerShell script:

Import-Module Adaxes
$user = Get-AdmUser "%distinguishedName%" -Properties MemberOf
if ($user.MemberOf -ne $Null)
{
    foreach ($groupDN in $user.MemberOf)
    {
        Remove-AdmGroupMember $groupDN -Members $user  -Confirm:$False
    }
}

Comments

I'm using your script for a scheduled task that is running everyday to clean up the disabled users.
Would it be possible to adjust the script in way that I do receive an email notification including all users that it has touched?

kind regards
Ingemar Jacob

---

Hello Jacob,

Do you want a separate email for each user that the task has touched or a summary email containing all users? Sending separate emails is better from the point of view of performance and will require only a slight modification of the script.

If you want a summary email for all users, that can also be done, however you need to keep in mind that you'll need to perform all actions on all users within a single script. That is, you'll need a script that will find all user accounts that need to be cleaned up, perform the necessary operations on each of them, and then send a summary report. This will require binding to each user within the script, that can take quite a lot of time if there are many users that you need to clean up.

Which of the options suits your needs best?

---

sorry for getting back to you that late. One mail per user would be okay for now instead of a summary

---

Hello Jacob,

Use the 3rd (last) version of the script in the following article in our Script Repository: Remove all group memberships for a user account.