Script exclusão de usuários windows server

Jackson Florêncio 0

Estou com um problema em um script que criei para fazer a exclusão dos usuários com mais de 30 dias sem logar, e fazer a exclusão de suas respectivas pastas no servidor, porém quando rodo o script não acontece nada, ele não dá nenhum erro, porém também não faz a exclusão do usuário no AD e nem suas pastas.

Estou iniciando o powershell como administrador.

Script:

Import-Module ActiveDirectory

$time = (Get-Date).AddDays(-30)

$users = Get-ADGroupMember "Suporte_Call" -recursive

$users = $users | Where-Object {($_.LastLogonDate -lt $time) -and ($_.SamAccountName -notin "veeam", "Default", "Publico", "Administrator")}

foreach($user in $users) {

    Remove-ADUser -Identity $user.SamAccountName -Confirm:$false

    $userFolder = "C:\Users\" + $user.SamAccountName

    Remove-Item $userFolder -Recurse -Force

    Write-Host "Usuário $($user.SamAccountName) excluído com sucesso."

}

1 answer

MotoX80 34,421 Reputation points

2023-01-31T13:54:56.1733333+00:00
Verify that your $users variable contains AD accounts.

$users = Get-ADGroupMember "Suporte_Call" -recursive "We found {0} users." -f $users.count $users = $users | Where-Object {($_.LastLogonDate -lt $time)} "{0} users match the logon criteria." -f $users.count $users = $users | Where-Object {($_.SamAccountName -notin "veeam", "Default", "Publico", "Administrator")} "We will process {0} users." -f $users.count
Please sign in to rate this answer.
Jackson Florêncio 0 Reputation points

2023-01-31T18:53:14.4266667+00:00

Parece não estar conseguindo validar:

"""
We found 67 users.

0 users match the logon criteria.

We will process 0 users.
"""

Porém se eu buscar pelos usuário sem logar a mais de 30 dias:

$Days = 10 $Time = (Get-Date).Adddays(-($Days)) Get-ADUser -Filter {LastLogonTimeStamp -lt $Time} -Properties * | Select Name, LastLogonDate

MotoX80 34,421 Reputation points

2023-02-01T01:23:16.58+00:00

I no longer have access to an AD environment to test this.

One difference is that you are using Get-Aduser in your example that works but Get-ADGroupMember in your initial post. The Get-ADuser call also has "-properties *" so it would appear that the LastLogonTimeStamp/LastLogonDate attributes are not being returned by the Get-ADGroupMember call.

Examine the first user and see if the last logon properties are included.

$users[0] | format-list -property *

See https://www.imanami.com/get-adgroupmember-cmdlet-in-powershell/

Try this.

$users = Get-ADGroupMember "Suporte_Call" -recursive "We found {0} users." -f $users.count $users = $users | Get-ADUser -Filter {LastLogonTimeStamp -lt $Time} -Properties * "{0} users match the logon criteria." -f $users.count

Jackson Florêncio 0 Reputation points

2023-02-01T20:42:06.4366667+00:00

Consegui ajustar para localizar por Get-ADUser, porém agora meu problema está sendo em fazer a exclusão dos usuários, recebo um acesso negado, mesmo estando como admin

MotoX80 34,421 Reputation points

2023-02-01T22:43:08.85+00:00

Application Data is a junction and has a deny entry for everyone.

It appears that a WMI call is the correct way to delete a profile.

https://learn-powershell.net/2011/01/27/use-powershell-to-remove-local-profiles/

https://stackoverflow.com/questions/60170092/how-do-you-delete-user-profiles-in-powershell

https://adamtheautomator.com/powershell-delete-user-profile/
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Script exclusão de usuários windows server

1 answer

Your answer