Monday, September 7, 2015

Powershell delete active directory user account...a little bit better

Hi mates,
how many times you asked to yourself : how can I delete active directory users ?
How can I do it storing administrative credentials and converting the result in JSON format ?
A friend of mine asked me a simple script to should be executed in a mixed environment : Linux/PHP and Windows.
He has to delete an active directory user account having as a back result, a JSON converted string.
Additionally he asked me to capture eventual errors
Let's see what I've done....quickly :




# the parameter here is mandatory : you can launch the script post-poning the samaccountname of the user that you want to delete
param(
[Parameter(Mandatory=$True,Position=1)]
[string]$samaccountname
)
import-module activedirectory
# here we setup the credentials to pass to the script to make Active Directory changes.
# we can also encode these parameter to a local test file avoiding the need to write them in clear text
# I'll show you how in a separate article
$strScriptUser = "mydomain\administrator"
$strPass = "mys3cre3tP@ssw0rd"
$PSS = ConvertTo-SecureString -String $strPass -AsPlainText -Force
$credentials = new-object -typename System.Management.Automation.PSCredential -argumentlist @($strScriptUser,$pss)
# here you have to customize typing the domain controller name
# with invoke-command we execute the code remotely passing the initial
# parameter declared inside the "scritblock" part
# we also flush the $error variable and two arrays that will contains success and failures
# I've inherited these arrays from a previous script where I needed to execute this kinf of operation
# in a loop, so the array had more sense than in this specific script
Invoke-Command -ComputerName mydc -ScriptBlock {
param ($rsamaccountname)
import-module activedirectory
$error.clear()
$arrayerrors = @();
$arraysuccessjson=@();
try{
# here we avoid the confirmation request
remove-aduser -identity $rsamaccountname -confirm:$false
$data = ("Username/SamaccountName Removed",$rsamaccountname)
$arraysuccessjson +=$data
# someone asked me to convert to JSON the output...you can comment this
$arraysuccessjson | convertto-json
}
Catch [system.exception]{
"User does not expist...exiting with 1"
$arrayerrors += ("Error Description : ",$Error)
$arrayerrors | convertto-json
exit 1
}
Finally
{
}
# here we pass the initial variable with the credentials captured before
}-ArgumentList $samaccountname -Credential $credentials
view raw del_users.ps1 hosted with ❤ by GitHub

No complications, no tricks, only the essential.
Hope this helps.
See you soon

7 comments:

  1. It's a bad practice just to delete an AD user, as you can leave a lot of things hanging in the environment, including access rights in connected systems. So instead of just deleting the account it's best to setup a full deprovisioning procedure that would include removing user from all groups, removing all access rights, removing accounts from all the systems associated with the AD user, etc.

    You can either do it with a script or a tool that can automate such tasks. Adaxes is good example, as you can basically combine the natively supported 'building blocks' tasks and/or execute your custom scripts: http://www.adaxes.com/active-directory_provisioning.htm

    ReplyDelete
  2. Thanks for your suggestion, I'll consider the product linked for my future script and/or administration activities. Thanks again

    ReplyDelete
  3. There are many small professional companies who provide IT support in Sydney as part of their services; this could range from desktop support to server virtualization and hosting services. Some of the biggest customers for these services range from construction companies, health clubs, hospitality services, real estate services etc. ibm lto 6 tape egypt

    ReplyDelete

  4. Great article! We are linking to this great article on our site. Keep up the good writing.



    3 شركة مكافحة حشرات بالمدينة المنورة
    http://prokr.com/company-spraying-pesticides-anti-insects-in-al-madina/
    شركات مكافحة الحشرات
    http://prokr.org
    مكافحة حشرات بالرياض
    http://albyaan.com/insect-control-companies-riyadh/
    مكافحة حشرات بالمدينة
    http://elbassma.net/anti-insects-companies-al-madina/

    ReplyDelete