Member Avatar for Sandman4040

Hi,

I'm using this script to copy 'Member Of..' permissions from one user to another.

Problem I have is that we have 5 domain controllers, what I find is when I delete ALL the groups from user2 (from their own domain controller) and then run the script, what I get is all the groups from user1 plus groups from user2 in the list again, what I'm thinking is that the groups are being copied from another domain controller. Ho do I sort it, do I have to remove user2's groups from ALL the domain controller prior to running this script?

Set NewUser=
Set UserLikeMe=
 
FOR /f "Tokens=*" %%a in ('dsquery user -samid %2') DO Set Newuser=%%a
 
IF NOT DEFINED NewUser (
    ECHO Could not find %2 in AD
    GOTO :EOF
)
 
ECHO New user found %NewUser%
 
FOR /f "Tokens=*" %%a in ('dsquery user -samid %1') DO Set UserLikeMe=%%a
IF NOT DEFINED UserLikeMe (
    ECHO Could not find %1 in AD
    GOTO :EOF
)
 
ECHO Copying groups from user %1 to user %2.
ECHO ===============================================================================>>CopyADGroupmembership.log
ECHO Copying groups from user %1 to user %2.>>CopyADGroupmembership.log
FOR /f "Tokens=*" %%a in ('dsget user %UserLikeMe% -memberof') do (
    dsmod GROUP %%a -addmbr %NewUser% | find /i "dsmod succeeded:"
    IF ERRORLEVEL 1 ECHO Copy not add group %%a to user %NewUser%>>CopyADGroupmembership.log
)
ECHO ===============================================================================>>CopyADGroupmembership.log
Edited by Sandman4040
  • 2 Contributors
  • 3 Replies
  • 198 Views
  • 2 Days Discussion Span
  • Latest Post Latest Post by JorgeM

Dani AI

Generated

Short answer: you should not have to delete user2's groups on every DC manually. If your domain controllers are healthy, AD is multi‑master and changes made on one writable DC will replicate. The behaviour you describe is usually caused by replication lag, the script binding to different DCs for reads vs writes, or an out‑of‑date/restored DC reintroducing old data. is right to point at replication; , start by checking that replication is actually healthy before changing procedure.

Basic checks and precautions:

  • Verify replication and DC health with repadmin /replsummary, repadmin /showrepl <DC> and dcdiag. Force a sync with repadmin /syncall /A /e /P if you need immediate convergence.
  • Make sure the script is binding to a single authoritative DC (use the -Server parameter in AD cmdlets or bind to a chosen LDAP server) so reads and writes use the same view.
  • Check for a restored or demoted/promoted DC (USN rollback/lingering objects) if deletions keep reappearing.

Recommended, reliable pattern (PowerShell, ActiveDirectory module):

  • Never try to write to memberOf directly: it’s a back‑link derived from groups’ member lists. Remove/Add membership by modifying groups.
  • Preserve the user’s primary group (primaryGroupID) when removing all other memberships.
  • Example pattern:
# variables
$src='user1'; $dst='user2'; $server='dc01.domain.local'

$dstObj = Get-ADUser $dst -Server $server -Properties MemberOf,primaryGroupID
$primary = (Get-ADGroup -Filter "primaryGroupToken -eq $($dstObj.primaryGroupID)" -Server $server).DistinguishedName

$dstObj.MemberOf | Where-Object { $_ -ne $primary } | ForEach-Object {
  Remove-ADGroupMember -Identity $_ -Members $dst -Confirm:$false -Server $server
}

(Get-ADUser $src -Server $server -Properties MemberOf).MemberOf | ForEach-Object {
  Add-ADGroupMember -Identity $_ -Members $dst -Server $server -ErrorAction SilentlyContinue
}

If groups still reappear after forcing replication and running the above, focus on DC health and any recently restored DCs. Log every add/remove while testing on a nonproduction account to isolate whether it’s replication or a script bug.

Recommended Answers

All 3 Replies

Member Avatar for JorgeM

If your domain controllers are healthy, you only need to take action once. All DCs in active directory are considered masters so replication would handle the changes.

Member Avatar for Sandman4040

Thanks for the reply, I'll have to check on Monday again.

Member Avatar for JorgeM

When you make a change to one user, it takes a certain amount time (intrasife vs intersite) to replicate changes. You also have this script issue which you described debut we don't know what it actually does.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.