Help with script to remove user from groups

this two-part question.

one of our user admin duties remove a user's group memberships when leave firm.  found script worked first few times tested stopped working reason (no error, didn't remove groups).  don't know powershell enough figure out why.  i'm hoping if can better understand each line of code can figure out it's going wrong.  below code have been running script file.  i'm using powershell v2, remember import ad module , set execution policy remote signed, , have rights perform action:

function removememberships
{
$user = get-aduser -identity mkg -properties memberof
$usergroups = $user.memberof
$usergroups | %{get-adgroup $_ | remove-adgroupmember -confirm:$false -member mkg}
}

in trying troubleshoot changed confirm true , seems problem getting group memberships - never prompted me confirm removal - don't know what's wrong or how fix it.  , frankly, experimenting particular script i'm bit hesitant do! 

secondly, there way better control results of cmdlet:  get-aduser - identity ttester -properties memberof | out-file h:\mygroups.txt?

what i'm trying here simple list of user's group memberships , save text file.  results i'm getting include more info need. not huge deal if there's way limit results group memberships, great. here's get: 

distinguishedname : cn=testera\, terry t.,ou=milwaukee,ou=qbusers,dc=na,dc=qb,dc=llp
enabled           : true
givenname         : terry
memberof          : {cn=all asg 1998 fiduciary income tax,ou=app security groups,ou=firm wide,dc=na,dc=qb,dc=llp, cn=al
                    l asg 1998 federal gift tax,ou=app security groups,ou=firm wide,dc=na,dc=qb,dc=llp}
name              : testera, terry t.
objectclass       : user
objectguid        : a870af2b-62cf-46e6-942e-7a44a8554cd3
samaccountname    : ttester
sid               : s-1-5-21-57989841-1935655697-725345543-63788
surname           : testera
userprincipalname : ttester@na.qb.llp 

 

first part:

this uses get-aduser find user name of mkg , returns user object includes memberof property

$user = get-aduser -identity mkg -properties memberof

this sets $usergroups groups returned previous command

$usergroups = $user.memberof

this loops through groups, , removes user group

$usergroups | %{get-adgroup $_ | remove-adgroupmember -confirm:$false -member mkg}

with last part said, can remove get-adgroup, , just use remove-adgroupmember

$usergroups | % { remove-adgroupmember -identity $_ -member mkg }

for second part:

get-aduser - identity ttester -properties memberof | out-file h:\mygroups.txt

that command returns user object includes group membership why see see, if want groups in file try

get-aduser - identity ttester -properties memberof | select-object -expandproperty memberof | out-file h:\mygroups.txt

---

if find post has answered question, please mark answer. if find post helpful in anyway, please click vote helpful.

don't retire technet

Windows Server  >  Windows PowerShell