如何批量将用户从多个Active Directory组中移除？

问题分析 #

你的代码无法批量处理的核心原因有两个：

1. Remove-ADPrincipalGroupMembership 不支持直接传入用户集合，必须逐个处理单个用户对象
2. 仅保留 sAMAccountName 会丢失AD用户对象的完整属性，导致cmdlet无法正确识别目标用户；同时循环组的方式会尝试将所有用户从每个组移除，不管用户是否属于该组，既低效又会产生大量无效操作

修正后的完整代码 #

# 1. 获取符合条件的完整AD用户对象（保留MemberOf属性用于后续组检查）
$EveryoneUsers = Get-ADUser -Filter {
    UserPrincipalName -notlike '131*' -and
    DistinguishedName -like '*OU=Staff*'
} -Properties MemberOf

# 2. 定义需要管理的目标组列表
$EveryoneGroups = @(
    'Iowa Everyone', 'South Everyone', 'Centennial Everyone', 'Union Everyone', 
    'East Valley Everyone', 'West Everyone', 'New Horizons Everyone', 'Columbia Everyone', 
    'Gateways Everyone', 'Nampa High Everyone', 'Snake River Everyone', 'Park Ridge Everyone', 
    'Skyview Everyone', 'District Office Everyone', 'Roosevelt Everyone', 'Central Everyone', 
    'Greenhurst Everyone', 'Nampa Early Childhood Everyone', 'Owyhee Everyone', 
    'District Operations Everyone', 'TVLA Everyone', 'Endeavor Everyone', 'Lake Ridge Everyone', 
    'Willow Creek Everyone', 'Reagan Everyone', 'Lone Star Everyone', 'Sherman Everyone'
)

# 3. 将组列表转换为哈希表（加快后续查找速度，同时验证组是否存在）
$targetGroups = @{}
foreach ($groupName in $EveryoneGroups) {
    $group = Get-ADGroup -Filter "Name -eq '$groupName'" -ErrorAction SilentlyContinue
    if ($group) {
        $targetGroups[$group.SID.Value] = $group
    } else {
        Write-Warning "未找到目标组：$groupName"
    }
}

# 4. 逐个处理用户，移除不属于当前Department的旧组
foreach ($user in $EveryoneUsers) {
    # 获取用户当前属于的目标组
    $userInTargetGroups = $user.MemberOf | ForEach-Object {
        $groupSID = (Get-ADObject $_ -Properties SID).SID.Value
        $targetGroups[$groupSID]
    } | Where-Object { $_ }

    if ($userInTargetGroups) {
        # 移除用户的旧组
        Remove-ADPrincipalGroupMembership $user -MemberOf $userInTargetGroups -Confirm:$false
        Write-Host "已清理用户 $($user.SamAccountName) 的旧组：$($userInTargetGroups.Name -join ', ')"
    }

    # （可选）根据Department属性添加用户到新的对应组
    $targetGroup = $EveryoneGroups | Where-Object { $_ -like "*$($user.Department)*" }
    if ($targetGroup -and $targetGroup -notin $userInTargetGroups.Name) {
        Add-ADGroupMember -Identity $targetGroup -Members $user -Confirm:$false
        Write-Host "已将用户 $($user.SamAccountName) 添加到组：$targetGroup"
    }
}

关键优化点 #

• 完整用户对象：保留AD用户的完整属性，确保Remove-ADPrincipalGroupMembership能正确识别目标
• 逐个用户处理：遍历每个用户，只移除该用户实际所属的目标组，避免无效操作
• 哈希表加速查找：提前将目标组转换为SID为键的哈希表，组名可能重复但SID唯一，提升检查效率同时验证组存在性
• 可选自动添加新组：整合了根据Department属性自动分配新组的逻辑，实现"移除旧组+添加新组"的完整流程

内容的提问来源于stack exchange，提问作者NorwegiaMan