如何將 AD 組與 Azure AD 組進行比較，如果不同則刪除成員

Question

我想比較 2 個組並從 Azure AD 組中刪除成員，如果它不同，但我有一個錯誤。 有人可以告訴我我做錯了什么嗎？

$membersofAzureADGroup = Get-AzureADGroup -Searchstring Test_Group | Get-AzureADGroupmember | Select Userprincipalname

$membersofADGroup = Get-ADGroupmember "Groupe_A" | Get-ADUser -properties Userprincipalname | Select UserPrincipalName

$RemoveUsers = Compare-Object -ReferenceObject $membersofAzureADGroup -DifferenceObject $membersofADGroup -PassThru | Where SideIndicator -eq "<="

Remove-AzureADGroupMember $RemoveUsers -Members $membersofAzureADGroup

Remove-AzureADGroupMember：找不到接受參數“@{UserPrincipalName=user@domain.com;SideIndicator=<=}”的位置參數

我在下面嘗試了這個但仍然無法正常工作......

Remove-AzureADGroupMember $RemoveUsers -MemberID (Get-AzureADUser | where {$_.Userprincipalname -eq $MembersOfGroup1}).ObjectID

Answer 1

我沒有 AD 或 Azure AD，但我遵循了您的問題的原則，並在我的計算機上本地測試了以下內容。 見下文

為什么你失敗是因為你的 $RemoveUsers 變量是錯誤的。 如果您沒有查看其中呈現的內容，我會感到驚訝。

為什么它不起作用

$RemoveUsers = Compare-Object -ReferenceObject $membersofAzureADGroup -DifferenceObject $membersofADGroup -PassThru | Where SideIndicator -eq "<="

在本地計算機測試中比較組

## Step 1 - Place both groups into variables
$Group1 = get-localgroup -Name Administrators | Get-LocalGroupMember | Select Name
$Group2 = get-localgroup -Name Test | Get-LocalGroupMember | Select Name
## Step 2 - See All Output 
$compare = Compare-Object -ReferenceObject $Group1 -DifferenceObject $Group2 -property name -passthru -IncludeEqual
## Step 3 See Only Difference in reference (source) object and select InputObject
$DifferenceInSource = (Compare-Object -ReferenceObject $Group1 -DifferenceObject $Group2 | Where SideIndicator -eq "<=" | Select -ExpandProperty InputObject)
## Step 4 Pull Out Names
$DifferenceInSourceName = $DifferenceInSource.Name
## Split WorkGroup and Account
$SplitName = $DifferenceInSourceName.Split('\')
## Step 5 Test To See If Account Resolves
Get-LocalUser -name $SplitName[1]

顯然，然后您圍繞ForEach語句構建以對多個引用進行更新。

Answer 2

刪除屬於 Azure AD 組但不是 Active Directory 組成員的用戶需要過濾，因此您絕對不需要Compare-Object 。

由於您正在嘗試查找另一個數組中不存在的數組元素，因此Where-Object或.Where(..)方法應該綽綽有余。

$ErrorActionPreference = 'Stop'

$azGName = 'Test_Group'
$adGName = 'Test_Group'

$azGroup = Get-AzureADGroup -Searchstring $azGName
$azMembers = Get-AzureADGroupmember $azGroup
$adMembers = (Get-ADGroupMember $adGName).Where({
    $_.ObjectClass -eq 'user'
}).UserPrincipalName
# NOTE: Piping Get-ADUser to Get-ADGroupMember will get in trouble whenever
#       there is a member that is not of the objectclass 'user'.

# Members of AZ Group that are not members of AD Group
$azMembers.Where({$_ -notin $adMembers.UserPrincipalName}).ForEach({
    "Removing $_ from $azGName"
    try
    {
        Remove-AzureADGroupMember -ObjectId $azGroup.ObjectId -MemberId $_.ObjectId
    }
    catch
    {
        Write-Warning $_.Exception
    }
})