[英]How to Compare AD Group with Azure AD Group and remove members if different
i would like to compare 2 groups and removes members from Azure AD Group if its different, but im having an error.我想比较 2 个组并从 Azure AD 组中删除成员,如果它不同,但我有一个错误。 Can someone tell me what im doing wrong?
有人可以告诉我我做错了什么吗?
$membersofAzureADGroup = Get-AzureADGroup -Searchstring Test_Group | Get-AzureADGroupmember | Select Userprincipalname
$membersofADGroup = Get-ADGroupmember "Groupe_A" | Get-ADUser -properties Userprincipalname | Select UserPrincipalName
$RemoveUsers = Compare-Object -ReferenceObject $membersofAzureADGroup -DifferenceObject $membersofADGroup -PassThru | Where SideIndicator -eq "<="
Remove-AzureADGroupMember $RemoveUsers -Members $membersofAzureADGroup
Remove-AzureADGroupMember: Cannot find a positional parameter that accepts the argument "@{UserPrincipalName=user@domain.com;SideIndicator=<=}" Remove-AzureADGroupMember:找不到接受参数“@{UserPrincipalName=user@domain.com;SideIndicator=<=}”的位置参数
I tried this below but still not working...我在下面尝试了这个但仍然无法正常工作......
Remove-AzureADGroupMember $RemoveUsers -MemberID (Get-AzureADUser | where {$_.Userprincipalname -eq $MembersOfGroup1}).ObjectID
I don't have AD or Azure AD, but I followed the principles of your issue and tested the following locally on my computer.我没有 AD 或 Azure AD,但我遵循了您的问题的原则,并在我的计算机上本地测试了以下内容。 See Below
见下文
Why you fail is because your $RemoveUsers variable is wrong.为什么你失败是因为你的 $RemoveUsers 变量是错误的。 I'd be surprised if you've not looked at what is being presented from it.
如果您没有查看其中呈现的内容,我会感到惊讶。
Why It Doesn't Work为什么它不起作用
$RemoveUsers = Compare-Object -ReferenceObject $membersofAzureADGroup -DifferenceObject $membersofADGroup -PassThru | Where SideIndicator -eq "<="
Compare Groups On A Local Computer Test在本地计算机测试中比较组
## Step 1 - Place both groups into variables
$Group1 = get-localgroup -Name Administrators | Get-LocalGroupMember | Select Name
$Group2 = get-localgroup -Name Test | Get-LocalGroupMember | Select Name
## Step 2 - See All Output
$compare = Compare-Object -ReferenceObject $Group1 -DifferenceObject $Group2 -property name -passthru -IncludeEqual
## Step 3 See Only Difference in reference (source) object and select InputObject
$DifferenceInSource = (Compare-Object -ReferenceObject $Group1 -DifferenceObject $Group2 | Where SideIndicator -eq "<=" | Select -ExpandProperty InputObject)
## Step 4 Pull Out Names
$DifferenceInSourceName = $DifferenceInSource.Name
## Split WorkGroup and Account
$SplitName = $DifferenceInSourceName.Split('\')
## Step 5 Test To See If Account Resolves
Get-LocalUser -name $SplitName[1]
Obviously you then structure around a ForEach statement to make the update on multiple references.显然,然后您围绕ForEach语句构建以对多个引用进行更新。
Removing users that are members of an Azure AD Group but are not a member of an Active Directory Group would require filtering and for that you definitely not need Compare-Object
.删除属于 Azure AD 组但不是 Active Directory 组成员的用户需要过滤,因此您绝对不需要
Compare-Object
。
Since you're trying to find elements of an array that do not exist on another array, Where-Object
or .Where(..)
method should be more than enough.由于您正在尝试查找另一个数组中不存在的数组元素,因此
Where-Object
或.Where(..)
方法应该绰绰有余。
$ErrorActionPreference = 'Stop'
$azGName = 'Test_Group'
$adGName = 'Test_Group'
$azGroup = Get-AzureADGroup -Searchstring $azGName
$azMembers = Get-AzureADGroupmember $azGroup
$adMembers = (Get-ADGroupMember $adGName).Where({
$_.ObjectClass -eq 'user'
}).UserPrincipalName
# NOTE: Piping Get-ADUser to Get-ADGroupMember will get in trouble whenever
# there is a member that is not of the objectclass 'user'.
# Members of AZ Group that are not members of AD Group
$azMembers.Where({$_ -notin $adMembers.UserPrincipalName}).ForEach({
"Removing $_ from $azGName"
try
{
Remove-AzureADGroupMember -ObjectId $azGroup.ObjectId -MemberId $_.ObjectId
}
catch
{
Write-Warning $_.Exception
}
})
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.