How to remove members when account is from Domain A and the group is from Domain B?

0

Here is my script:

# get distinguished name
$grpDN = (Get-QADGroup mw\AAA).dn
$UsrDN = (Get-QADUser sw\tx116).dn
# using Remove-QADGroupMember
Remove-QADGroupMember -Identity $grpDN -Member $UsrDN

Here is the error:

Remove-QADGroupMember : The server is unwilling to process the request. (Exception from HRESULT: 0x80072035)

I also tried to use

Remove-AdgroupMember 
Remove-ADPrincipalGroupMembership

Both cmdlets give me error with "Cannot find an object with identity" because they cannot handle cross domain.

What is the solution for this?

powershell
scripting
active-directory
asked on Stack Overflow Aug 8, 2018 by Liang Cui • edited Aug 8, 2018 by Ansgar Wiechers

1 Answer

1

Did you ever work this out?

Try

# get the group and user objects using the -Server parameter, something like this:
$Group = Get-ADGroup -Filter "Name -eq 'AAA'" -Server "DomainA.com"
$User  = Get-ADUser -Filter "Name -eq 'tx116'" -Server "DomainB.com"

# then remove the user, again with the -Server parameter set to the group domain
Set-ADObject -Identity $($Group.DistinguishedName) -Remove @{member="$($User.DistinguishedName)"} -Server "DomainA.com"
answered on Stack Overflow Aug 19, 2018 by Theo

User contributions licensed under CC BY-SA 3.0