This PowerShell script removes a user from groups in the CORP and AUSTIN domains, disables the user account in both domains, moves the user to the disabled accounts OU in CORP and the terms OU in AUSTIN, and logs any errors to a text file. It authenticates with credentials for each domain, gets group memberships, removes the user from all groups except domain users, disables and moves the user account, and handles errors throughout.

1. <#Import in modules, if statement for PSSnapin so that it doesn't throw
an error if it is already loaded.#>
Import-Module ActiveDirectory
if ( (Get-PSSnapin -Name Microsoft.Exchange.Management.PowerShell.Admin -
ErrorAction SilentlyContinue) -eq $null )
{
add-pssnapin Microsoft.Exchange.Management.PowerShell.Admin
}
<#Clear variables so they are not retaining any old values#>
Get-Variable -Exclude PWD,*Preference | Remove-Variable -EA 0
<#Variables Decalred#>
$errorLogPath = "c:scriptslogstermUserGroups.txt"
$corpCred = Get-credential -Message "This is the CORP domain" -
ErrorAction Stop
$ausCred = Get-Credential -Message "This is the AUSTIN domain" -
ErrorAction Stop
$ausDC = "SanitizedServerName.austin.kmvtechnologies.com"
$corpDC = "SanitizedServerName.corp.logitech.com"
$ausDisableOU =
"OU=Terms,OU=Corporate,DC=austin,DC=kmvtechnologies,DC=com"
$corpDisableOU =
"OU=DisabledAccounts,OU=LifeSize,OU=Users,OU=WWLogi,DC=corp,DC=logitech,D
C=com"
<#Test CORP credentials#>
$usernameCorp = $corpCred.username
$passwordCorp = $corpCred.GetNetworkCredential().password
$corpDomain =
"LDAP://SanitizedServerName.corp.logitech.com".distinguishedName
$domainCorp = New-Object
System.DirectoryServices.DirectoryEntry($corpDomain,$usernameCorp,$passwo
rdCorp) -ErrorAction Stop
if ($domainCorp.name -eq $null)
{
write-host "Authentication failed for domain CORP - please verify your
username and password."
exit #terminate the script.
}
else
{
write-host "Successfully authenticated with domain CORP"
}
<#Test AUSTIN Domain credentials#>
$usernameAus = $AusCred.username
$passwordAus = $AusCred.GetNetworkCredential().password
$ausDomain =
"LDAP://SanitizedServerName.austin.kmvtechnologies.com".distinguishedName
$domainAus = New-Object
System.DirectoryServices.DirectoryEntry($ausDomain,$usernameAus,$password
Aus) -ErrorAction Stop
if ($domainAus.name -eq $null)

2. {
write-host "Authentication failed for domain AUSTIN - please verify your
username and password."
exit #terminate the script.
}
else
{
write-host "Successfully authenticated with domain AUSTIN"
}
While($true)
{
$employee = Read-Host "Enter CORP user account to remove groups from, or
press Cntrl+C to exit:" -ErrorAction Stop
$fileCreationTime = Get-Date -UFormat "%Y%m%d%H%M%S" -ErrorAction Stop
$txtFolderPath = Join-Path "SanitizedServerNameIT-
DocumentationGroupRemovals" $fileCreationTime$employee.txt -ErrorAction
Stop
<#Grab Corp Group membership and spit out to list#>
Try {
Get-ADPrincipalGroupMembership -Server $corpDC -Identity $employee -
Credential $corpCred -ErrorAction Stop | select Name | Out-File
$txtFolderPath -ErrorAction Stop }
Catch {
Write-Warning "Problem in CORP group list creation... logging error to
$errorLogPath!"
Write-Warning $Error[0]
$fileCreationTime | Out-File $errorLogPath -Append
$Error[0] | Out-File $errorLogPath -Append
Write-Warning "Error creating file of group names" | Out-File
$errorLogPath -Append }
Try{
Get-ADUser $employee -Server $corpDC -Credential $corpCred -ErrorAction
Stop | FL | Out-File -Append $txtFolderPath -ErrorAction Stop }
Catch {
Write-Warning "Problem appending CORP object properties to file...
logging error to $errorLogPath!"
Write-Warning $Error[0]
$fileCreationTime | Out-File $errorLogPath -Append
$Error[0] | Out-File $errorLogPath -Append
Write-Warning "Error appending object properties to file" | Out-File
$errorLogPath -Append }
Write-Output "List of CORP groups exported, beginning removal of CORP
groups...."
<#create object array of memberof from a users AD object, then step
through and remove each group #>
Try{
$user = Get-ADUser $employee -Server $corpDC -Properties memberof -
Credential $corpCred -ErrorAction Stop }
Catch {

3. Write-Warning "Problem getting array of group names... logging error to
$errorLogPath!"
Write-Warning $Error[0]
$fileCreationTime | Out-File $errorLogPath -Append
$Error[0] | Out-File $errorLogPath -Append
Write-Warning "Error ennumerating group list" | Out-File $errorLogPath -
Append }
$userGroups =$user.memberof
Try{
$userGroups | %{get-adgroup $_ -Server $corpDC -Credential $corpCred -
ErrorAction Stop | Remove-ADGroupMember -Server $corpDC -Credential
$corpCred -confirm:$false -member $employee -ErrorAction Stop } }
Catch {
Write-Warning "Problem removing CORP group memberships... logging error
to $errorLogPath!"
Write-Warning $Error[0]
$fileCreationTime | Out-File $errorLogPath -Append
$Error[0] | Out-File $errorLogPath -Append
Write-Warning "Error removing CORP groups memebership" | Out-File
$errorLogPath -Append }
Write-Output "CORP groups removal complete, beginning move to CORP
disabled accounts OU...."
<#Disable AUS account in case it isn't disabled, then move the object to
the Disabled accounts OU#>
Try{
Disable-ADAccount -Identity $employee -Server $corpDC -Credential
$corpCred -ErrorAction Stop}
Catch {
Write-Warning "Problem disabling CORP ... logging error to
$errorLogPath!"
Write-Warning $Error[0]
$fileCreationTime | Out-File $errorLogPath -Append
$Error[0] | Out-File $errorLogPath -Append
Write-Warning "Error disabling CORP user account" | Out-File
$errorLogPath -Append }
Try{
Get-ADUser $employee -Server $corpDC -Credential $corpCred -ErrorAction
Stop | Move-ADObject -TargetPath $corpDisableOU -Server $corpDC -
Credential $corpCred -ErrorAction Stop }
Catch{
Write-Warning "Problem moving CORP user account to Disabled OU ...
logging error to $errorLogPath!"
Write-Warning $Error[0]
$fileCreationTime | Out-File $errorLogPath -Append
$Error[0] | Out-File $errorLogPath -Append
Write-Warning "Error moving CORP account to Disabled OU" | Out-File
$errorLogPath -Append }
Write-Output "User CORP account disabled..."

4. <#grabbing the user mailbox by matching Linked Master account, with teh
$mailbox object we can call the attributes by .attribute notation ex:
$mailbox.SamAccountName#>
Try{
$mailbox = Get-Mailbox -Credential $ausCred -DomainController $ausDC -
ResultSize Unlimited -ErrorAction Stop | where {$_.LinkedMasterAccount -
like "CORP$employee"} }
Catch{
Write-Warning "Problem getting user Linked mailbox ... logging error to
$errorLogPath!"
Write-Warning $Error[0]
$fileCreationTime | Out-File $errorLogPath -Append
$Error[0] | Out-File $errorLogPath -Append
Write-Warning "Error getting CORP user linked Mailbox object" | Out-File
$errorLogPath -Append }
Write-Output "Mailbox Object created..."
<#Use the $mailbox object to input user values in cmdlets, get groups
memberships and append o txt file for user, and also append attributes to
file#>
Try{
Get-ADPrincipalGroupMembership -Server $ausDC -Identity
$mailbox.SamAccountName -Credential $ausCred -ErrorAction Stop | select
name | Out-File -Append $txtFolderPath -ErrorAction Stop }
Catch{
Write-Warning "Problem in AUSTIN group list creation... logging error to
$errorLogPath!"
Write-Warning $Error[0]
$fileCreationTime | Out-File $errorLogPath -Append
$Error[0] | Out-File $errorLogPath -Append
Write-Warning "Error creating file of AUSTIN group names" | Out-File
$errorLogPath -Append }
Try{
Get-ADUser -Identity $mailbox.SamAccountName -Server $ausDC -Credential
$ausCred -ErrorAction Stop | FL | Out-File -Append $txtFolderPath -
ErrorAction Stop }
Catch{
Write-Warning "Problem appending AUSTIN object properties to file...
logging error to $errorLogPath!"
Write-Warning $Error[0]
$fileCreationTime | Out-File $errorLogPath -Append
$Error[0] | Out-File $errorLogPath -Append
Write-Warning "Error appending AUSTIN object properties to file" | Out-
File $errorLogPath -Append }
Write-Output "List of AUS groups exported..."
<#Use the SAM account name of the mailbox that was matched by linked
master account, then step though loop to remove all groups except Domain
users#>
Try{
$userAus = Get-ADUser $mailbox.SamAccountName -Server $ausDC -Properties
memberof -Credential $ausCred -ErrorAction Stop }

5. Catch{
Write-Warning "Problem getting array of AUSTIN group names... logging
error to $errorLogPath!"
Write-Warning $Error[0]
$fileCreationTime | Out-File $errorLogPath -Append
$Error[0] | Out-File $errorLogPath -Append
Write-Warning "Error ennumerating AUSTIN group list" | Out-File
$errorLogPath -Append }
$userGroupsAus = $userAus.memberof
Try{
$userGroups | %{get-adgroup $_ -Server $ausDC -Credential $ausCred -
ErrorAction Stop | Remove-ADGroupMember -Server $ausDC -Credential
$ausCred -confirm:$false -member $mailbox.SamAccountName -ErrorAction
Stop } }
Catch{
Write-Warning "Problem removing AUSTIN group memberships... logging error
to $errorLogPath!"
Write-Warning $Error[0]
$fileCreationTime | Out-File $errorLogPath -Append
$Error[0] | Out-File $errorLogPath -Append
Write-Warning "Error removing AUSTIN groups membership" | Out-File
$errorLogPath -Append }
Write-Output "AUS groups removed, disabling AUS user, Moving to Terms
OU..."
<#Disable AUS account in case it isn't disabled, then move the object to
the Terms OU#>
Try{
Disable-ADAccount -Identity $mailbox.SamAccountName -Server $ausDC -
Credential $ausCred -ErrorAction Stop }
Catch{
Write-Warning "Problem disabling AUSTIN ... logging error to
$errorLogPath!"
Write-Warning $Error[0]
$fileCreationTime | Out-File $errorLogPath -Append
$Error[0] | Out-File $errorLogPath -Append
Write-Warning "Error disabling AUSTIN user account" | Out-File
$errorLogPath -Append }
Try{
Get-ADUser $mailbox.SamAccountName -Server $ausDC -Credential $ausCred -
ErrorAction Stop | Move-ADObject -TargetPath $ausDisableOU -Server $ausDC
-Credential $ausCred -ErrorAction Stop }
Catch{
Write-Warning "Problem moving AUSTIN user account to Disabled OU ...
logging error to $errorLogPath!"
Write-Warning $Error[0]
$fileCreationTime | Out-File $errorLogPath -Append
$Error[0] | Out-File $errorLogPath -Append
Write-Warning "Error moving AUSTIN account to Disabled OU" | Out-File
$errorLogPath -Append }
Write-Output "Script finished check OU and accounts..."

6. }