how many times you asked to yourself : how can I delete active directory users ?
How can I do it storing administrative credentials and converting the result in JSON format ?
A friend of mine asked me a simple script to should be executed in a mixed environment : Linux/PHP and Windows.
He has to delete an active directory user account having as a back result, a JSON converted string.
Additionally he asked me to capture eventual errors
Let's see what I've done....quickly :
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
# the parameter here is mandatory : you can launch the script post-poning the samaccountname of the user that you want to delete | |
param( | |
[Parameter(Mandatory=$True,Position=1)] | |
[string]$samaccountname | |
) | |
import-module activedirectory | |
# here we setup the credentials to pass to the script to make Active Directory changes. | |
# we can also encode these parameter to a local test file avoiding the need to write them in clear text | |
# I'll show you how in a separate article | |
$strScriptUser = "mydomain\administrator" | |
$strPass = "mys3cre3tP@ssw0rd" | |
$PSS = ConvertTo-SecureString -String $strPass -AsPlainText -Force | |
$credentials = new-object -typename System.Management.Automation.PSCredential -argumentlist @($strScriptUser,$pss) | |
# here you have to customize typing the domain controller name | |
# with invoke-command we execute the code remotely passing the initial | |
# parameter declared inside the "scritblock" part | |
# we also flush the $error variable and two arrays that will contains success and failures | |
# I've inherited these arrays from a previous script where I needed to execute this kinf of operation | |
# in a loop, so the array had more sense than in this specific script | |
Invoke-Command -ComputerName mydc -ScriptBlock { | |
param ($rsamaccountname) | |
import-module activedirectory | |
$error.clear() | |
$arrayerrors = @(); | |
$arraysuccessjson=@(); | |
try{ | |
# here we avoid the confirmation request | |
remove-aduser -identity $rsamaccountname -confirm:$false | |
$data = ("Username/SamaccountName Removed",$rsamaccountname) | |
$arraysuccessjson +=$data | |
# someone asked me to convert to JSON the output...you can comment this | |
$arraysuccessjson | convertto-json | |
} | |
Catch [system.exception]{ | |
"User does not expist...exiting with 1" | |
$arrayerrors += ("Error Description : ",$Error) | |
$arrayerrors | convertto-json | |
exit 1 | |
} | |
Finally | |
{ | |
} | |
# here we pass the initial variable with the credentials captured before | |
}-ArgumentList $samaccountname -Credential $credentials |
No complications, no tricks, only the essential.
Hope this helps.
See you soon
It's a bad practice just to delete an AD user, as you can leave a lot of things hanging in the environment, including access rights in connected systems. So instead of just deleting the account it's best to setup a full deprovisioning procedure that would include removing user from all groups, removing all access rights, removing accounts from all the systems associated with the AD user, etc.
ReplyDeleteYou can either do it with a script or a tool that can automate such tasks. Adaxes is good example, as you can basically combine the natively supported 'building blocks' tasks and/or execute your custom scripts: http://www.adaxes.com/active-directory_provisioning.htm
Thanks for your suggestion, I'll consider the product linked for my future script and/or administration activities. Thanks again
ReplyDeleteThere are many small professional companies who provide IT support in Sydney as part of their services; this could range from desktop support to server virtualization and hosting services. Some of the biggest customers for these services range from construction companies, health clubs, hospitality services, real estate services etc. ibm lto 6 tape egypt
ReplyDelete
ReplyDeleteGreat article! We are linking to this great article on our site. Keep up the good writing.
3 شركة مكافحة حشرات بالمدينة المنورة
http://prokr.com/company-spraying-pesticides-anti-insects-in-al-madina/
شركات مكافحة الحشرات
http://prokr.org
مكافحة حشرات بالرياض
http://albyaan.com/insect-control-companies-riyadh/
مكافحة حشرات بالمدينة
http://elbassma.net/anti-insects-companies-al-madina/
Thanks for reading and linking
ReplyDeleteThanks a lot
ReplyDeleteIt was really informative. Your website is extremely helpful.
ReplyDeletehttp://decor-ksa.com/
http://decor-ksa.com/doors-gallery/
http://decor-ksa.com/windows-gallery/
http://decor-ksa.com/railings-staircase-gallery/
http://decor-ksa.com/iron-doors/
http://decor-ksa.com/steel-doors/
http://decor-ksa.com/laser-cut-doors/
http://decor-ksa.com/villas-doors/