You can remove user accounts from Active Directory groups with the Active Roles Console.
To remove a user account from a group
-
In the Console tree, locate and select the folder that contains the user account you want to remove from a group.
-
In the details pane, right-click the user account, then click Properties.
-
On the Member Of tab in the Properties dialog, clear the Show nested groups check box, select the group from which you want to remove the user account, and click Remove.
NOTE: Consider the following when removing a user account from a group:
-
If you have not cleared the Show nested groups check box, the list on the Member Of tab also includes the groups to which the user account belongs indirectly, that is, because of group nesting. If you select such a group from the list, the Remove button is unavailable. A user account can be removed from only those groups of which the account is a direct member.
-
The user account cannot be removed from its primary group (Domain Users by default). You first need to change the user’s primary group. For more information, see How to change the primary group of a user.
NOTE: The primary user group applies only to users who log in to the network through Services for Macintosh, or to users who run POSIX-compliant applications. If the user you configure does not use any of these services, do not change the primary group from the default Domain Users setting.
To change the primary group of a user, right-click the account, click Properties, and go to the Member Of tab. On the Member Of tab, select a group from the list and click Set Primary Group.
NOTE: You can only set a global or universal security group as the primary group of the user. If you select a group with the group scope set to Domain local, or you select a distribution group, then the Set Primary Group button not be available.
You can change the primary group of a user with the Active Roles Console.
To change the primary group of a user
-
In the Console tree, locate and select the folder that contains the user account whose primary group you want to change.
-
In the details pane, right-click the user account, then click Properties.
-
On the Member Of tab in the Properties dialog, click the group that you want to set as the primary group of the user, then click Set Primary Group.
NOTE: Consider the following when changing a user's primary group:
-
Primary groups are used exclusively by Macintosh clients and POSIX-compliant applications. Unless you are using these services, there is no need to change the primary group from Domain Users, which is the default value.
-
A user’s primary group must be in the same domain as the user’s account and the primary group must be either a global or universal security group.
-
Setting the user’s primary group membership to a value other than Domain Users may adversely affect performance as all users in the domain are members of Domain Users. If the user’s primary group is set to another group, it may cause the group membership to exceed the supported maximum number of members.
To perform Exchange tasks on a user account, right-click the account, click Exchange Tasks, and follow the instructions in the Exchange Task Wizard. The Exchange Task Wizard helps you manage Exchange recipients by providing a set of tasks that apply to the selected account.
