Private/Remove-NSPConditionalAccessAdGroupMember.ps1
|
function Remove-NSPConditionalAccessAdGroupMember { <# .SYNOPSIS Removes one user from an on-premises group (undo of a coverage add). Wrapped so tests never touch AD. #> [CmdletBinding(SupportsShouldProcess)] [OutputType([string])] param( [Parameter(Mandatory)][string]$GroupIdentity, [Parameter(Mandatory)][string]$UserIdentity ) Import-Module ActiveDirectory -ErrorAction Stop -Verbose:$false $group = Get-ADGroup -Identity $GroupIdentity -ErrorAction Stop $user = Get-ADUser -Identity $UserIdentity -Properties MemberOf -ErrorAction Stop if (@($user.MemberOf) -notcontains $group.DistinguishedName) { return 'NotMember' } if ($PSCmdlet.ShouldProcess($group.SamAccountName, "Remove $($user.SamAccountName)")) { Remove-ADGroupMember -Identity $group -Members $user -Confirm:$false -ErrorAction Stop } 'Removed' } |