functions/Disable-User.ps1
|
Function Disable-User { <# .SYNOPSIS This script will carry out some basic actions against an AD User to disable their access and process them as a leaver Actions include: DEFAULT - Disable AD Account - Change password - Set Mail Nickname (so that hide from GAL works) - Hide from GAL - Clear Title, Manager, Department and Company Fields - Set description to "Disabled: (date & time)" - Remove from all groups - Move to leaver OU - Set Mailbox to shared OPTIONAL - Forward emails - Delegate mailbox .NOTES Name: Disable-User Author: Elliott Marter TO ADD Login to EOL and add a check for this Set mailbox to shared Forward emails Delegate emails Remove Licences .EXAMPLE Disable-User -Username john.smith -Forward mr.boss@contoso.com -Delegate mr.boss@contoso.com .LINK https://www.powershellgallery.com/profiles/elliottmarter #> [CmdletBinding()] param( [Parameter(Position=0,mandatory=$true)] [string] $Username, [string] $Forward, [string] $Delegate ) $Logfile = "$env:SystemDrive\elm_tools_logs\leaver_logs\$Username.txt" New-Item $Logfile -Force -Confirm:$false | Out-Null Write-Output "Logfile is here $Logfile" -ForegroundColor Green # Call function to ask for Leaver OU $LeaverOU = (Select-ADOrganizationalUnit -Message "Select Leaver OU").DistinguishedName # Quick try catch to validate the username and confirm run try { $User = Get-ADUser -Identity $Username $Confirm = Read-Host "$($User.UserPrincipalName) will be disabled, Do you wish to contiune? Y/N" } catch { throw "ERROR: Could not find $($Username), please try again" } # If block against confirm to do the first bit of local AD work # LOCAL AD If ($Confirm -eq "Y") { # Disable Account Disable-ADAccount $User -Confirm:$false | Tee-Object $Logfile -Append # Set New Password $Pass = (iwr https://www.dinopass.com/password/strong -UseBasicParsing).Content Set-ADAccountPassword -Identity $User -Reset -NewPassword (ConvertTo-SecureString -AsPlainText "$Pass" -Force) Write-Output "Password has been reset to $Pass" | Tee-Object $Logfile -Append # Set MailNickName try { Set-ADObject $User -Replace @{MailNickName=$user.SamAccountName} Write-Output "Mailnickname set to $($user.SamAccountName)" | Tee-Object $Logfile -Append } catch { Write-Output "ERROR: Unable to set mailNickname attribute (AD schema may not have Exchange attributes)" -ForegroundColor Red | Tee-Object $Logfile -Append } # Hide From GAL try { Set-ADObject $User -Replace @{msExchHideFromAddressLists=$true} Write-Output "$($user.SamAccountName) hidden from GAL" | Tee-Object $Logfile -Append } catch { Write-Output "ERROR: Unable to set msExchHideFromAddressLists attribute (AD schema may not have Exchange attributes)" -ForegroundColor Red | Tee-Object $Logfile -Append } # Clear Title, Manager, Department and Company try { Set-ADUser $User -Title $null -Manager $null -Department $null -Company $null Write-Output "Title, Manager, Department and Company has been cleared" | Tee-Object $Logfile -Append } catch { } # Set description to date disabled $Description = "Disabled: $((get-date).ToString())" Set-ADUser $User -Description $Description Write-Output "Descripton set to $Description" | Tee-Object $Logfile -Append # Remove From all groups $Groups = Get-AdPrincipalGroupMembership -Identity $User.SamAccountName | Where-Object -Property Name -Ne -Value 'Domain Users' Write-Output "$($user.SamAccountName) is being removed from the following groups" | Tee-Object $Logfile -Append Write-Output $($Groups.Name) | Tee-Object $Logfile -Append $Groups | Remove-AdGroupMember -Members $User -Confirm:$false # Move to Leaver OU Move-ADObject $User -TargetPath $LeaverOU Write-Output "$($user.SamAccountName) has been moved to $LeaverOU" | Tee-Object $Logfile -Append } # Set Mail forwarding If ($Forward) { Set-Mailbox -Identity $User.UserPrincipalName -DeliverToMailboxAndForward $true -ForwardingSMTPAddress "$Forward" } # Set Mail delegation If ($Delegate) { Add-MailboxPermission -Identity $User.UserPrincipalName -User $Delegate -AccessRights FullAccess -InheritanceType All } } |