Remove-AdmPrincipalGroupMembership

Question

My code works in the powershell ISE, but doesn't work in Adaxes admin console, and I have no idea why...

Here is my code:

Import-module Adaxes
$userDN = "%username%"

$Groups = Get-ADMPrincipalGroupMembership -Identity $UserDN -AdaxesService localhost     
$User = Get-AdmUser -Identity $UserDN -Properties info
Set-AdmUser -Identity $UserDN -Clear info
$notes = $User.info
Foreach ($dg in $Groups)
    {
    If ($dg.name -eq "Domain Users")
        {
        }
    Else
        {
            $SplitString = $dg.ToString()
            $holder = $SplitString -split ","
            $RemovedGroup += "`r`n"+$holder[0]
            Remove-AdmPrincipalGroupMembership -Identity $UserDN -MemberOf $dg
        }
    }
$notes = "$notes `r`n **The user has been removed from the following groups **`r`n$RemovedGroup`r`n ************* End of Group List"

Set-AdmUser -Identity $UserDN -Add @{info=$notes}

When I run the code via the ISE on the server, it works. however, when running this code via a Custom command I get the following error:

Cannot invoke this function because the current host does not implement it.

Any ideas? I know it's the Remove-AdmPrincipalGroupMembership -Identity $UserDN -MemberOf $dg line because if I comment that line out, the script works.

Thanks
Jon.

*edit*
I also tried to use

Remove-ADMGroupMember -Identity $dg.DistinguishedName -Members $userDN

and got the same error message.

Comments

I'm guessing this got missed accidentally?

Answer 1

Hello,

Sorry for a delayed reply. The thing is that removing a user from a group is a sensitive operation, and the Remove-AdmPrincipalGroupMembership cmdlet always prompts for confirmation of this operation. This works well when you call the cmdlet from the PowerShell Console or PowerShell ISE, however, currently, Adaxes does not support prompting for user input from PowerShell scripts run by Business Rules, Custom Commands and Scheduled Tasks. Thus, when the cmdlet attempts to show the confirmation prompt, you get the error message.

To workaround this, you need to disable the confirmation. For this purpose, when calling the cmdlet from your script, you need to set the -Confirm parameter of the cmdlet to false. For this purpose, find the following line in your script:

Remove-AdmPrincipalGroupMembership -Identity $UserDN -MemberOf $dg

and append -Confirm:$False:

Remove-AdmPrincipalGroupMembership -Identity $UserDN -MemberOf $dg -Confirm:$False

This should do the job.

Comments

yep, that was stupid of me.

Thanks, that did the trick.

---

Hello

Remove-AdmPrincipalGroupMembership -Identity $UserDN -MemberOf $dg -Confirm:$False

This also goes for Remove-AdmGroupMember.

This could be noticed on in the SDK at both cmdlets.

- Thanks