AFP548

Mass deletion of users/group membership

I want to mass delete users and ensure that the uid for each of those users is no longer a member of any group. In our previous openLDAP implementation running on linux, this could be a concern because new users with the same uid as a previous user could inherit group memberships. So, I had it set up such that removal from all groups happened in tandem with the delete. On the surface this is easy - dscl can accomplish the user delete without a problem. However, it appears that uid's for the deleted users are only removed from their group memberships if you use Workgroup Manager to delete the user. And, I don't really see how I can get Workgroup Manager to handle a mass deletion of selected records. //rant Workgroup Manager sorely needs a full command line equivalent. //end rant Should I even be concerned about this? It at least appears that I should be because I just tested it and it looks like a new user will inherit the group of a previous user with the same uid. However, I'm not sure and all these special Apple group membership attributes are confusing. Does anyone have a script for doing this?
Exit mobile version