MIM 2016: Remove values from a Multivalue reference attribute

Lets look at this use case

I want to remove 8000 users from the ExplicitMember attribute of the group object in the Portal. I go to the group, go to advanced highlight all and delete. Then I submit it and I get timed out. I turn off the group validation MPRs and I still get timed out. A lot depends on how you have the user object configured in the portal, if your users are members of a lot of criteria groups and sets and multivalue attributes, removing them involves a lot of SQL resources which leads to the time out.

So lets use Lithnet PowerShell, should be simple?

I do this

$mygroups=search-resources -xpath “/Group[DisplayName=’TLKGroup1]” -AttributesToGet ExplicitMember

$mygroups – $null

Save-resource $mygroups

I get another time out. Again 8000 is too much for SQL to compute at once.

What we need to do is to get the user ObjectIDs from the ExplicitMember, convert it to string attribute value and remove from the ExplcitMember in batches.

#get the groups

$mygroups=search-resources -xpath “/Group[DisplayName=’TLKGroup1]” -AttributesToGet ExplicitMember


#put in string array


foreach($egroup in $mygroups.explicitmember){[string]$mygroup=$egroup;$mygroup2=$mygroup.substring(9);$usersremove+=$mygroup2}

#Remove from Explicitmember in batches
[int]$count=0;[int]$count2=0;foreach($user in usersremove){$count++;$count2++;$mygroups.explicitmember.remove($user);if($count -eq 200){write-host “Done ” $count2 ” out of ” $total;save-resource $mygroups;$count=0}}

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s