Delete duplicate member group in user account - powershell

Question

In my company, I have a PowerShell script to copy group from one user to another. But it happens that I have two groups which one Denied access and the other Allow acces.
For example, after copying, I could have that in the user account :
FIC-LSM-APP-BO5-DND
FIC-LSM-APP-BO5-MAJ
I would like to delete the Denied access group with a script.
Here my code:
Import-Module ActiveDirectory
[void][System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic')
$nomuser = [Microsoft.VisualBasic.Interaction]::InputBox("Login de >l'utilisateur à traiter", "A traiter", "")
$nommodele = [Microsoft.VisualBasic.Interaction]::InputBox("Nom du >modèle", "Modèle", "")
try {
$user = Get-ADUser -Identity $nomuser -Properties memberOf
} catch {
[System.Windows.Forms.MessageBox]::Show("Utilisateur $nomuser non >trouvé","Erreur",[System.Windows.Forms.MessageBoxButtons]::OK,[System.Windows.Forms.MessageBoxIcon]::Error)
exit
}
try {
$usertemplate = Get-ADUser -Identity $nommodele -Properties memberOf
} catch {
[System.Windows.Forms.MessageBox]::Show("Utilisateur modèle $nomuser >non trouvé","Erreur",[System.Windows.Forms.MessageBoxButtons]::OK,[System.Windows.Forms.MessageBoxIcon]::Error)
exit
}
$Groups = $User.MemberOf | ForEach-Object {
Get-ADGroup $_
}
$groups = $Usertemplate.MemberOf | ForEach-Object {
Get-ADGroup $_
}
$Groups | ForEach-Object {
Add-ADGroupMember -Identity $_ -Members $user
}
$user = Get-ADUser -Identity $nomuser -Properties memberOf
$user.MemberOf | Get-ADGroup |
Group-Object {$_.Name -replace '^(.*)-(?:DND|MAJ)$', '$1'} |
Where-Object { $_.Count -eq 2 } | Select-Object -Expand Group |
Remove-ADGroupMember -Members $user -Confirm:$false
$user.MemberOf | ogv -Title "Nouvelle liste d'appartenance pour $nomuser"
I finally have time and a test data base to perform this code.
However I have a problem. For example :
Groups of $nomuser : FIC-LSM-APP-BO5-DND
Group of $nommodele : FIC-LSM-APP-BO5-MAJ
When I run the code, the target user ($nomuser) haven't no more group... I think there is an error in the code, but where I don't know.

Answer 1

You can use Group-Object to determine whether a user is member of both allow and deny group. The cmdlet allows you to specify custom matching criteria in a scriptblock, so you can remove a trailing -DND or -MAJ from the group name and group by the group "basename":
$user.MemberOf | Get-ADGroup |
Group-Object {$_.Name -replace '^(.*)-(?:dnd|maj)$', '$1'}
Use Where-Object to filter the result for groups with a count of 2 and expand the Group property to get the original AD groups:
... | Where-Object { $_.Count -eq 2 } | Select-Object -Expand Group | ...
Use another Where-Object filter to restrict the groups to just the ones you want to remove the user from (e.g. with a filter Name -like '*-dnd'), then remove the user from those groups:
... | Remove-ADGroupMember -Members $user -Confirm:$false