AD Group Membership Removal Script Not Working 100% - Need Assistance - powershell

Question

I'll start off by saying that I am not a scripting expert at all. But I was tasked with creating a script to remove all group memberships of all users in a specified OU (called DISABLE) a few months ago.
Long story short, the script works great most of the time, but on random occasions it won't remove 1 (random) group for a user , or 2, or sometimes more, and I can't figure out what the reasoning is. The script used is:
#Remove User Group Memberships
$ou = Get-ADUser -SearchBase "OU=DISABLE,OU=CE,DC=ourdomain,DC=org" -Filter *
foreach ($user in $ou) {
$UserDN = $user.DistinguishedName
$user.PrimaryGroupID = 513
set-aduser -instance $user
Get-ADGroup -LDAPFilter "(member=$UserDN)" | foreach-object {
if ($_.name -ne "Domain Users") {remove-adgroupmember -identity $_.name -
member $UserDN -Confirm:$False} }
}
Any help that can be provided would be greatly appreciated, thank you!

Answer 1

Instead of searching for users, and then searching for all groups that user is a member of, just include that in your first search. This has the benefit of fewer AD searches, and less chance that an AD search misses the user.
#Remove User Group Memberships
$ou = Get-ADUser -SearchBase "OU=DISABLE,OU=CE,DC=ourdomain,DC=org" -Filter * -Property MemberOf
foreach ($user in $ou) {
$UserDN = $user.DistinguishedName
$user.PrimaryGroupID = 513
set-aduser -instance $user
$user.MemberOf |
Where{$_ -notmatch "Domain.?Users"} |
ForEach {remove-adgroupmember -identity $_ -member $UserDN -Confirm:$False}
}
Try that and see if you get better mileage out of it. Also, consider that perhaps some of these are protected groups, and the account that you run the script under doesn't have rights to affect those groups. Check these users that aren't being removed from groups and see if they have their AdminCount property set to 1.