Recently I ran into an issue at my company removing a user in our primary domain from a group in our root domain using the AD cmdlets in PowerShell. All my company’s user, computer, and group objects are in our primary domain and our root domain is more of a resource forest. The group in question was an Exchange RBAC role in the resource forest. So, when I first attempted the removal as such
Remove-ADGroupMember -Identity “HelpDesk Exchange Tasks” -members doej
I got the following error
Remove-ADGroupMember : Cannot find an object with the Identity: ‘HelpDesk Exchange Tasks’ under: ‘DC=corp,DC=contoso,DC=com’.
At first it seemed obvious that the solution was to use a domain controller in our resource domain to perform the task. So, I tried referencing a DC in the resource domain
Remove-ADGroupMember -Identity “HelpDesk Exchange Tasks” -members doej -server FRDC500.root.contoso.com
But got the following error
Remove-ADGroupMember : Cannot find an object with the Identity: ‘CN=doel,OU=US,OU=CORP,DC=corp,DC=contoso,DC=com’’ under: ‘DC=root,DC=contoso,DC=com’.
At that point I didn’t know how to proceed so I did some searching on the internet and came across an MS blog entry entitled Adding/removing members from another forest or domain to groups in Active Directory
Basically, you need to
- Choose against what domain server you want to run the command against.
- Get the default returned property set of the object in the other domain, referencing a domain controller in that domain if needed
- Run the command referencing just the name/samaccountname/CN/DN of the object that will be referenced by the server in the command and for the object in the other domain use the full object
- Referencing just the name/samaccountname/CN/DN OR even just selecting those properties on the object will not work. It needs to be the full default object as returned by the get-AD* command you are using to get the object
So, in my example I pulled the PDCEmulator from the resource domain (where the group was) and the default domain (where the user object was)
$DC_In_Root = (Get-ADDomain root.contso.com).PDCEmulator $DC_In_Default = (Get-ADDomain corp.contso.com).PDCEmulator
Then I saved the default returned property set of the user object in the current domain (I didn’t need to reference a DC in this domain since it was my default working domain, but it’s done here for clarity’s sake)
$Default_Domain_User = Get-Aduser doej -server $DC_In_Default
In my example, I’m going to use the DC in my root domain to remove the user from the group. So, I only need to reference the group in this domain by name/samaccountname/CN/DN BUT the user needs to be referenced as an object with it’s complete default returned property set. The opposite can be done if needed
Remove-ADGroupMember -Identity “HelpDesk Exchange Tasks” -members $Default_Domain_User -server $DC_In_Root
I’m not sure why it needs to be the complete default property set. In my limited testing, removing just one of the properties caused it to fail.
