How do i use WGM or dcsl to change the primary groups of users, defined by another group?

Question

i've got a ton of users, whose primary group is "current student". they all belong to the other group "year 13"
they've left school, so i thought it would be easy to do a search of users with GID equal to or containing the GID for "year 13" (in this case 1121) and then change their primary group to "left school"
except that doesn't work. i can only search for them in WGM by primary group, it seems. therefore i cannot do any batch operations on a secondary group.
so. how do i do this? is there a way of scripting dcsl to find users by 'other group' and then change the primary group attribute?
i'm going to need to be doing a lot of this (changing the other gropus of a school full of students). bit stumped.
help!

Answer 1

ok. for some reason neitehr root nor my account (which is part of the open directory admin group) can make changes using dscl.
when addingremoving users from groups, remember that teh UUID has to be added/removed too
this is getting there:
old=year11
new=year12
for item in `dscl /LDAPv3/127.0.0.1/ read /Groups/$old GroupMembership | cut -d: -f2`
do
echo $item
UUID=`dsmemberutil getuuid -U $item`
case "$UUID"
          in
          "There is no uuid for user $item")
                    echo "user $item need personal attention"
                    dscl -u diradmin -P 'somepassword'  /LDAPv3/127.0.0.1 append /Groups/$new GroupMembership $item
                    dscl -u diradmin -P 'somepassword'  /LDAPv3/127.0.0.1 append /Groups/$new GroupMembers $UUID
                    if [ "`dsmemberutil checkmembership -U $item -G $new`" == "user is a member of the group" ]  ; then
                    echo "$item added to $new"
                    dscl -u diradmin -P 'somepassword'  /LDAPv3/127.0.0.1 delete /Groups/$old GroupMembership $item
                    dscl -u diradmin -P 'somepassword'  /LDAPv3/127.0.0.1 delete /Groups/$old GroupMembers $UUID
                              if [ "`dsmemberutil checkmembership -U $item -G $old`" == "user is a member of the group" ]  ; then
                              echo "removal of $item from $old failed"
                              else
                              echo "removal of $item from $old succeded"
                              fi
                    else echo "append of $item to $new failed"
                    fi
          esac
done