Home » PowerShell » PowerShell Remove User from Group

PowerShell Remove User from Group

Remove-LocalGroupMember in PowerShell is used to remove user from group. Remove-AdGroupMember in PowerShell is used to remove active directory group members.

Removing users from a group is very common when users leave an organization or move to another business group.

In this article, we will discuss how to get members of a local group, remove user from group and remove all users from a group on the remote machine with PowerShell.

Let’s practice!

Remove-LocalGroupMember

Remove-LocalGroupMember removes users or groups from the local group.

Syntax

Remove-LocalGroupMember
      [-Group] <LocalGroup>
      [-Name] <String>
      [-SID] <SecurityIdentifier>
      [-Member] <LocalPrincipal[]>
      [-WhatIf]
      [-Confirm]
      [<CommonParameters>]

Parameters

Group – Specifies the group from which cmdlet removes the members.

Member – Specifies an array of users or groups. Remove-LocalGroupMember cmdlet takes it as input to remove members from the specified security group.

Name – Specifies the name of the group from which the members will be removed.

SID – Specifies the security identifier of the group from which the members will be removed.

Cool Tip: How to check active directory group membership using PowerShell!

Remove User from Local Group

To remove user from local group, check what are the users in the local administrators group.

To get members of the local administrator’s group, use Get-LocalGroupMember in PowerShell.

Get-LocalGroupMember -Group 'Administrators'

The above Get-LocalGroupMember uses Group to get users from the Administrators group.

It displays ObjectClass, Name, and PrincipalSource members for each user associated with the group.

Get members to remove user from group
Get members to remove user from group

As we have users from an Administrators group, remove user from local group using Remove-LocalGroupMember.

Remove-LocalGroupMember -Group 'Administrators' -Members 'CORP-EU-101\Administrator'

The above script, Remove-LocalGroupMember removes users from the group associated with the group name ‘Administrators’.

Cool Tip: How to get list of users in AD group using PowerShell!

Remove all users from group

You can remove all users from the local group using the Remove-LocalGroupMember cmdlet in PowerShell.

Get-LocalGroupMember -Group 'Administrators' | Where {$_.objectclass -like 'User'} | Remove-LocalGroupMember Administrators

Get-LocalGroupMember command gets all the group members associated with the Administrators group.

It uses where condition to check object class like ‘User’ and passes the output to the third command.

Remove-LocalGroupMember in PowerShell removes all users from a local group.

Cool Tip: How to get a domain name using PowerShell!

Remove user from group on remote computer

You can use Invoke-command to invoke the script to remove user from group on a remote computer.

$remote-comp = 'Corp-EU-101'
Invoke-Command -ComputerName $remote-comp -ScriptBlock {
  Get-LocalGroupMember -Group 'Administrators' | Where {$_.objectclass -like 'User'} | Remove-LocalGroupMember Administrators

In the above PowerShell script to remove user from group on a remote computer, invoke-command invoke script block to run on the computer specified by ComputerName.

Cool Tip: Using Active Directory UserAccountControl flags in PowerShell!

Using Get-LocalGroupMember gets all administrators groups on the remote computer and passes the output to the second command.

Where condition checks for objectclass like ‘User’ and passes the output to the third command.

Remove-LocalGroupMember cmdlet in PowerShell removes all users from the Administrators group on the remote machine.

Cool Tip: How to remove aduser in PowerShell!

Conclusion

It’s best practice for PowerShell administrators to check regularly for user rights in their network and remove them when they leave an organization or group.

Using Get-LocalGroupMember in PowerShell returns all local group members.

Using Remove-LocalGroupMember in PowerShell removes users or groups from a local group.

Cool Tip: PowerShell echo equivalent command in Windows!

You can find more topics about PowerShell Active Directory commands and PowerShell basics on the ShellGeek home page.

Leave a Comment