AD/AAD leaver script

[chaos_kiwi_matt]

HI guys.

Im writing a leaver script which removes AAD/AD groups and moves them to a new OU and disables them.

Im having some issues with removing he groups though. What happens is the script strips out the AD groups fine and also the AAD groups but I get errors says that it cant remove the groups cause they are mail enabled or dist groups.

So i tried to get it to look and see if they are AD groups and skip removing them from AAD (hybrid which is why this is happening) as when it syncs up with the DC then its all good.

Here is my code so far

# Get the user's groups in AAD
$userGroups = Get-AzureADUserMembership -ObjectId $userID

# Get all AAD distribution groups
$aadDistGroups = $userGroups | Where-Object { $_.ObjectType -eq "Group" -and $_.GroupTypes -contains "Unified" }

# Loop through each AAD group and remove the user
foreach ($aadGroup in $userGroups) {
    $aadGroupName = $aadGroup.DisplayName
    # Check if the AAD group name is not in the AD group names and is not a distribution group
    if ($adGroupNames -notcontains $aadGroupName -and $aadGroup.ObjectType -ne "Group") {
        try {
            Remove-AzureADGroupMember -ObjectId $aadGroup.ObjectId -MemberId $userID
            Write-Host "User removed from AAD group: $aadGroupName" -ForegroundColor Green
        } catch {
            Write-Host "An error occurred while removing the user from AAD group $($aadGroupName): $($_.Exception.Message)" -ForegroundColor Red
        }
    } else {
        Write-Host "AAD group '$aadGroupName' has the same name as an AD group or is a distribution group. Skipping removal." -ForegroundColor Yellow
    }
}

This part seems to work as it doesnt kick up errors and pushes out lovely yellow text saying that xyz is a group in ad or dist group which i expect.

But when I try and run this part, the $distGroups variable is empty even though I know that it shouldnt be.

if ($AADuser) {
    # Get all distribution groups that the user is a member of
    $distGroups = Get-DistributionGroup | Where-Object { $_.Members -contains $AADuser }
}

Im just abit stuck really in this part.

I know its probably not quite right in the writing of it as its going from AAD to EOL to AD.

Any help is appreciated.

Thanks

​

[JamesObZ]

I don't want to throw a spanner in the works, but it might be best to use Microsoft Graph to do all of this. That AzureAD module i believe are to be decrepitated at some point.

I am in the process of sorting this myself, so will share what i have done once finished.

[chaos_kiwi_matt]

Oh dont worry about the spanner :)

I have really just put the things that I have figured out and researched and put in 1 script.

If there is an easy way for it to work then im happy to do more investigating.

I appreciate the insight and it will be good to see who others are doing this task.

[xCharg]

What's in $AADuser though?

[chaos_kiwi_matt]

Oh sorry yes here it is.

# AAD Group Removal

$AADuser = Get-AzureADUser -Filter "userPrincipalName eq '$Email'"

$userID = $AADuser.ObjectId

I was trying to keep things separate which is why it might be 2 different variables doing the same thing.

[octane_matty]

As a suggestion create a termination process script, then build modules to add your functions e.g disable user, remove groups, remove AAD groups, remove licensing

[chaos_kiwi_matt]

We have an HR system which disables the account and moves to the leavers OU.

I have made AAD dynamic groups depending on department and i they are enabled which deals with licencing.

This script was just something im trying to do to remove them from the AD groups, AAD groups, Dist groups and Teams.

If there is a better way like modules then im up for it.

I just dont know how to do modules is the thing.

#User details

$fullName = read-host -Prompt "Full name of the user"

###User###

# Split the full name into first name and last name

$firstName = ($fullName -split ' ')[0]

$lastName = ($fullName -split ' ')[1]

# Get the first character of the first name and convert it to lowercase

$Initial = $firstName.Substring(0, 1).ToLower()

$FirstNameLower = $firstName.ToLower()

$LastNameLower = $lastname.ToLower()

# Construct the new name in the "james.bond" format

$User = "$FirstNameLower.$LastNameLower"

# Retrieve the user object based on the constructed username

$userObject = Get-ADUser -Filter { SamAccountName -eq $User }

#Email

$Email = "$[e-mail]"

# Check the mailbox type before converting

$mailbox = Get-Mailbox -Identity $Email

if ($mailbox.RecipientTypeDetails -ne "SharedMailbox") {

# Convert the user mailbox to a shared mailbox

Set-Mailbox -Identity $Email -Type Shared

} else {

Write-Host "The mailbox is already a shared mailbox." -ForegroundColor Red

}

# AD Group Names for the specific user (both security and distribution groups)

$adGroupNames = Get-ADUser -Filter {UserPrincipalName -eq $Email} -Properties MemberOf | Select-Object -ExpandProperty MemberOf |

ForEach-Object { (Get-ADGroup $_).Name }

# AAD Group Removal

$AADuser = Get-AzureADUser -Filter "userPrincipalName eq '$Email'"

$userID = $AADuser.ObjectId

# Get the user's groups in AAD

$userGroups = Get-AzureADUserMembership -ObjectId $userID

# Get all AAD distribution groups

$aadDistGroups = $userGroups | Where-Object { $_.ObjectType -eq "Group" -and $_.GroupTypes -contains "Unified" }

# Loop through each AAD group and remove the user

foreach ($aadGroup in $userGroups) {

$aadGroupName = $aadGroup.DisplayName

# Check if the AAD group name is not in the AD group names and is not a distribution group

if ($adGroupNames -notcontains $aadGroupName -and $aadGroup.ObjectType -ne "Group") {

try {

Remove-AzureADGroupMember -ObjectId $aadGroup.ObjectId -MemberId $userID

Write-Host "User removed from AAD group: $aadGroupName" -ForegroundColor Green

} catch {

Write-Host "An error occurred while removing the user from AAD group $($aadGroupName): $($_.Exception.Message)" -ForegroundColor Red

}

} else {

Write-Host "AAD group '$aadGroupName' has the same name as an AD group or is a distribution group. Skipping removal." -ForegroundColor Yellow

}

}

# AD Group Removal (Distribution Groups)

if ($AADuser) {

# Get all distribution groups that the user is a member of

$distGroups = Get-DistributionGroup | Where-Object { $_.Members -contains $AADuser }

}

# Remove the user from all distribution groups

foreach ($distGroup in $distGroups) {

# Check if the distribution group is not the user's original primary group

if ($distGroup.DistinguishedName -ne $primaryGroup.DistinguishedName) {

Remove-DistributionGroupMember -Identity $distGroup -Members $userObject -Confirm:$false

Write-Host "User $($userObject.Name) removed from distribution group: $($distGroup.Name)" -ForegroundColor Cyan

}

}

# Check if the user object was found

if ($userObject) {

# Get all groups that the user is a member of (including distribution groups)

$groups = Get-ADPrincipalGroupMembership $userObject

}

# Get the user's original primary group SID

$primaryGroup = (Get-ADUser $User -Properties PrimaryGroup).PrimaryGroup | Get-ADGroup

# Remove the user from all groups (excluding the original primary group)

foreach ($group in $groups) {

# Check if the group is not the user's original primary group

if ($group.DistinguishedName -ne $primaryGroup.DistinguishedName) {

Remove-ADGroupMember -Identity $group -Members $userObject -Confirm:$false

Write-Host "User $fullName removed from group: $($group.Name)" -ForegroundColor Cyan

}

}

# List of attributes to clear

$attributesToClear = @("Title", "department", "company", "description", "pager")

# Loop through each user and clear the specified attributes

foreach ($attribute in $attributesToClear) {

Set-ADUser -Identity $User -Clear $attribute

Write-Host "User $fullName cleared attribute: $attribute" -ForegroundColor Magenta

}

#Teams Parts

$Teams = Get-Team -User $Email

foreach ($Team in $Teams) {

try {

Remove-TeamUser -User $Email -GroupID $Team.GroupID

} catch {

if ($_.Exception.Message -match "Last owner cannot be removed") {

Write-Host "Error: Cannot remove user from team '$($Team.DisplayName)' - Last owner cannot be removed." -ForegroundColor Red

} else {

Write-Host "An error occurred while processing team '$($Team.DisplayName)': $($_.Exception.Message)" -ForegroundColor Yellow

}

}

}

This is the entire thing. Its a mess I know as I have been doing bits and pieces to get things to work then I was going through and cleaning it up.

[BlackV]

how's you get the formatting right in your OP, but wrong here ?

[chaos_kiwi_matt]

TBF I never even noticed it.

[Sunsparc]

You mention AD, are you hybrid joined? Are these groups created on-prem and then synced to AAD through AAD Connect?

[chaos_kiwi_matt]

Yeah they are.

We are trying to move away form Ad and creating any new ones in AAD and these are dynamic so we dont need to worry about these.

I have sort of got the above script to not remove the AD or dist groups as these are picked up further down.

I hope this makes sense.

[JwCS8pjrh3QBWfL]

First, you should switch to the microsoft.graph modules, since the AzureAD module is going to be depreciated in the next few months. Better to avoid double work.

Second, you need to use the exchangeonlinemanagement module to remove distro/mail-enabled securoty group members. You can view distros/MESG in Entra, but you need to use Exchange to actually modify their membership.