I'm working on a python script to automate some management tasks. I would take a look at the python-ldap package. So far it is working well. I'm doing almost exactly what Mark mentions. -----Original Message----- From: 389-users-bounces(a)lists.fedoraproject.org [mailto:389-users-bounces@lists.fedoraproject.org] On Behalf Of Mark Reynolds Sent: Wednesday, August 08, 2012 3:23 PM To: General discussion list for the 389 Directory server project. Subject: Re: [389-users] Delete users from different groups Fosiul, The best practice is to first locate the groups that the user belongs to by using a search filter like this: ldapsearch -D "cn=directory manager" -w password -b "dc=example,dc=com" "(|(uniquemember=uid=name,dc=example,dc=com)(memberUid=uid=name,dc=example,dc=com))" Of course you could easily expand this filter to include other attributes like member: (|(uniquemember=uid=name,dc=example,dc=com)(memberUid=uid=name,dc=example,dc=com)(member=uid=name,dc=example,dc=com)) Then you can do a ldapmodify to remove the user from the group(s): ldapmodify -D "cn=directory manager" -w password dn: cn=group,dc=example,dc=com changetype: modify delete: uniquemember uniquemember: uid=name,dc=example,dc=com Mark On 08/08/2012 02:53 PM, Fosiul Alam wrote: -- Mark Reynolds Senior Software Engineer Red Hat, Inc mreynolds(a)redhat.com -- 389 users mailing list 389-users(a)lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/389-users