PowerShell脚本移除用户组权限异常：通讯组/邮件安全组所有者未移除求助

需要编写PowerShell脚本，将指定用户从其作为成员或所有者的所有组中移除，涉及组类型包括：

• 通讯组（Distribution List）
• 安全组（Security Group）
• 邮件启用安全组（Mail-Enabled Security Group）
• Office 365组

已尝试脚本，但无法将用户从其作为所有者的通讯组和邮件启用安全组中移除。

1. Exchange组遍历效率低下：原脚本遍历所有通讯组，而非直接获取用户作为所有者的组，浪费资源且易出错。
2. ManagedBy参数处理错误：Set-DistributionGroup的-ManagedBy @{Remove = "$userEmail"}写法存在兼容性问题，部分场景下无法识别邮箱地址；同时未正确处理多所有者场景。
3. 权限不足：若当前账号无Exchange组管理权限（如DistributionGroups.ReadWrite.All），会导致所有者移除失败。

# 连接Microsoft Graph，需确保权限足够
Connect-MgGraph -Scopes "User.Read.All", "Group.Read.All", "GroupMember.ReadWrite.All", "GroupOwner.ReadWrite.All", "Directory.Read.All"

# 连接Exchange Online
Connect-ExchangeOnline

# 目标用户邮箱
$userEmail = "test@*****.onmicrosoft.com"

# --- 第一部分：Azure AD + Office 365组处理 ---
$userObj = Get-MgUser -Filter "mail eq '$userEmail' or userPrincipalName eq '$userEmail'" `
    -ConsistencyLevel eventual -All -Property Id, DisplayName, UserPrincipalName, Mail | Select-Object -First 1

if (-not $userObj) {
    Write-Host "未在Microsoft Graph中找到用户 $userEmail，跳过AAD组移除操作"
}
else {
    Write-Host "找到目标用户: $($userObj.DisplayName) ($($userObj.UserPrincipalName))"

    # 获取用户作为成员的所有组
    $memberGroups = Get-MgUserMemberOf -UserId $userObj.Id -All | Where-Object { $_.AdditionalProperties.'@odata.type' -eq '#microsoft.graph.group' }
    # 获取用户作为所有者的所有组
    $ownerGroups = Get-MgUserOwnedObject -UserId $userObj.Id -All | Where-Object { $_.AdditionalProperties.'@odata.type' -eq '#microsoft.graph.group' }

    # 合并所有需要处理的组（去重）
    $allGroups = ($memberGroups + $ownerGroups) | Select-Object Id -Unique | ForEach-Object { Get-MgGroup -GroupId $_.Id }

    foreach ($group in $allGroups) {
        if ($group.GroupTypes -contains "DynamicMembership") {
            Write-Host "跳过动态组: $($group.DisplayName)"
            continue
        }

        # 移除成员身份
        try {
            Remove-MgGroupMemberByRef -GroupId $group.Id -DirectoryObjectId $userObj.Id -ErrorAction Stop
            Write-Host "已从组 $($group.DisplayName) 移除成员身份"
        }
        catch {
            if ($_.Exception.Message -notmatch "does not exist in the group") {
                Write-Host "移除成员身份失败（组: $($group.DisplayName)）: $($_.Exception.Message)"
            }
        }

        # 移除所有者身份
        try {
            Remove-MgGroupOwnerByRef -GroupId $group.Id -DirectoryObjectId $userObj.Id -ErrorAction Stop
            Write-Host "已从组 $($group.DisplayName) 移除所有者身份"
        }
        catch {
            if ($_.Exception.Message -notmatch "does not exist as an owner") {
                Write-Host "移除所有者身份失败（组: $($group.DisplayName)）: $($_.Exception.Message)"
            }
        }
    }
}

# --- 第二部分：Exchange通讯组 + 邮件启用安全组处理 ---
try {
    # 直接获取用户作为所有者的Exchange组
    $userOwnedExchangeGroups = Get-DistributionGroup -ResultSize Unlimited | Where-Object {
        $_.ManagedBy -and ($_.ManagedBy.PrimarySmtpAddress -ieq $userEmail)
    }

    # 获取用户作为成员的Exchange组
    $userMemberExchangeGroups = Get-DistributionGroupMember -Identity $userEmail -ResultSize Unlimited | ForEach-Object {
        Get-DistributionGroup -Identity $_.Identity
    } | Select-Object Identity, DisplayName -Unique

    # 合并需要处理的Exchange组（去重）
    $allExchangeGroups = ($userOwnedExchangeGroups + $userMemberExchangeGroups) | Select-Object Identity, DisplayName -Unique

    foreach ($group in $allExchangeGroups) {
        # 移除成员身份
        try {
            $isMember = Get-DistributionGroupMember -Identity $group.Identity -ResultSize Unlimited | Where-Object {
                $_.PrimarySmtpAddress -ieq $userEmail
            }
            if ($isMember) {
                Remove-DistributionGroupMember -Identity $group.Identity -Member $userEmail -BypassSecurityGroupManagerCheck -Confirm:$false -ErrorAction Stop
                Write-Host "已从Exchange组 $($group.DisplayName) 移除成员身份"
            }
        }
        catch {
            Write-Host "移除Exchange组成员身份失败（组: $($group.DisplayName)）: $($_.Exception.Message)"
        }

        # 移除所有者身份
        try {
            $groupDetails = Get-DistributionGroup -Identity $group.Identity
            $currentOwners = $groupDetails.ManagedBy | Where-Object { $_.PrimarySmtpAddress -ine $userEmail }
            # 更新所有者列表，排除目标用户
            Set-DistributionGroup -Identity $group.Identity -ManagedBy $currentOwners -BypassSecurityGroupManagerCheck -Confirm:$false -ErrorAction Stop
            Write-Host "已从Exchange组 $($group.DisplayName) 移除所有者身份"
        }
        catch {
            Write-Host "移除Exchange组所有者身份失败（组: $($group.DisplayName)）: $($_.Exception.Message)"
        }
    }
}
catch {
    Write-Host "Exchange组处理失败: $($_.Exception.Message)"
}

Write-Host "清理脚本执行完成"

1. 权限要求：
   • Microsoft Graph需添加GroupOwner.ReadWrite.All权限，用于修改组所有者
   • Exchange Online账号需具备Exchange管理员或组管理员角色，确保能修改通讯组的所有者设置
2. 效率优化：
   • 直接获取用户作为成员/所有者的组，而非遍历所有组，提升执行速度
   • 对组进行去重处理，避免重复操作
3. 错误处理：
   • 忽略"用户不在组中"这类非关键性错误，减少不必要的报错信息
   • 针对Exchange组所有者，通过重新设置所有者列表的方式确保移除生效，而非依赖@{Remove}语法

内容的提问来源于stack exchange，提问作者microsoftdeveloperdesigner