ADGroup: unable to remove trusted domain members from group

Details of the scenario you tried and the problem that is occurring

DomainA and DomainB are trusting each other with external trusts. Using the ADGroup resource, I can add DomainA\TestUser to DomainB\group, but removing the same DomainA\TestUser from DomainB\group generates the error:

Cannot find an object with identity: 'CN=TestUser,DC=DomainA,DC=local' under: 'DC=DomainB,DC=local'.

I've tested both using the Members and MembersToExclude properties, with the same result.

Verbose logs showing the problem

DETTAGLIATO: [DC2]: LCM:  [ Start  Resource ]  [[ADGroup]testgrp]
DETTAGLIATO: [DC2]: LCM:  [ Start  Test     ]  [[ADGroup]testgrp]
DETTAGLIATO: [DC2]:                            [[ADGroup]testgrp] Retrieving group membership based on 'DistinguishedName' property. (ADG0001)
DETTAGLIATO: [DC2]:                            [[ADGroup]testgrp] Group membership is NOT in the desired state. (ADG0002)
DETTAGLIATO: [DC2]: LCM:  [ End    Test     ]  [[ADGroup]testgrp]  in 0.2350 seconds.
DETTAGLIATO: [DC2]: LCM:  [ Start  Set      ]  [[ADGroup]testgrp]
DETTAGLIATO: [DC2]:                            [[ADGroup]testgrp] Retrieving group membership based on 'DistinguishedName' property. (ADG0001)
DETTAGLIATO: [DC2]:                            [[ADGroup]testgrp] Updating AD Group 'testgrp'. (ADG0006)
DETTAGLIATO: [DC2]:                            [[ADGroup]testgrp] Retrieving group membership based on 'DistinguishedName' property. (ADG0001)
DETTAGLIATO: [DC2]:                            [[ADGroup]testgrp] Removing '3' member(s) from AD group 'testgrp'. (ADG0004)
Cannot find an object with identity: 'CN=TestUser,DC=DomainA,DC=local' under: 'DC=DomainB,DC=local'.
    + CategoryInfo          : ObjectNotFound: (CN=TestUser,DC=DomainA,DC=local:) [], CimException
    + FullyQualifiedErrorId : SetADGroupMember.ValidateMembersParameter,Microsoft.ActiveDirectory.Management.Commands.RemoveADGroupMember

Suggested solution to the issue

Looking at the resource code with my limited skills it seems to me that we're adding users with the Add-ADCommonGroupMember function and we're removing users with the Windows built-in AD Remove-ADGroupMember cmdlet.

Outside ADGroup, I can reproduce the same error using the Windows AD powershell cmdlet, both trying to Add and Remove DomainA\TestUser to/from DomainB\TestGrp. The following commands ran on DomainB domain controller both generate the same error:

Add-ADGroupMember -Identity TestGrp -Members 'CN=TestUser,DC=DomainA,DC=local'

Add-ADGroupMember : Cannot find an object with identity: Cannot find an object with identity: 'CN=TestUser,DC=DomainA,DC=local' under: 'DC=DomainB,DC=local'.

Remove-ADGroupMember -Identity TestGrp -Members 'CN=TestUser,DC=DomainA,DC=local'

Remove-ADGroupMember : Cannot find an object with identity: Cannot find an object with identity: 'CN=TestUser,DC=DomainA,DC=local' under: 'DC=DomainB,DC=local'.

Could the same code used in the Add-ADCommonGroupMember fuction be used with minor changes to have a working Remove-ADCommonGroupMember function ? I've tried, but failed with my basic powershell skills.

The DSC configuration that is used to reproduce the issue (as detailed as possible)

# This code succesfully adds both DomainA\TestUsers and Domain\B TestUser to 
# DomainB\TestGrp ADGroup "testgrp". Removing the 'CN=TestUser,DC=DomainA,DC=local' 
# user from the Members list afterwards generates the error:

ADGroup "testgrp"
            {
            GroupName           = "testgrp"
            GroupScope          = 'DomainLocal'
            Category            = 'Security'
            Ensure              = 'Present'
            Path                = "OU=Groups,DC=DomainB,DC=local"
            MembershipAttribute = 'DistinguishedName'
            Members             = @(
                                   'CN=TestUser,DC=DomainA,DC=local'
                                   'CN=TestUser,DC=DomainB,DC=local'
                                   )
            }

The operating system the target node is running

OsName : Microsoft Windows Server 2016 Standard
OsOperatingSystemSKU : StandardServerEdition
OsArchitecture : 64-bit
WindowsBuildLabEx : 14393.3297.amd64fre.rs1_release_1.191001-1045
OsLanguage : en-US
OsMuiLanguages : {en-US}

Name Value

---

PSVersion 5.1.14393.3053
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.14393.3053
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1

Version of the DSC module that was used

ActiveDirectoryDsc version 6.0.0

Start at the ADGroup resource's membership update path and compare Add-ADCommonGroupMember with the Remove-ADGroupMember path for Members and MembersToExclude. Reproduce the cross-domain distinguished-name case from the configuration and verify that removing DomainA\TestUser from the DomainB group completes without the reported object-not-found error.