Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

Set Manager attribute to null when account is disabled using Powershell

Posted on 2009-04-04
3
Medium Priority
?
1,302 Views
Last Modified: 2012-05-06
We would like to run a nightly job that sets the "manager" attribute to NULL if the account is disabled.  A Powershell script is preferred.  Can someone help?
0
Comment
Question by:sanderson321
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
3 Comments
 
LVL 10

Expert Comment

by:Rudram
ID: 24073189
* How about a VB Script that would enumerate the domain and look for all disabled accounts and then if found, set their "Manager" attribute in the Organization tab as NULL (basically the CLEAR function of ADUC User account property)

* While entering the domain name, provide the FQDN of the domain.

Hope this helps (^_^)
Option Explicit
 
Const ADS_PROPERTY_CLEAR = 1
 
Dim strDomain, objComputer, objUser, oRoot,strDefaultNamingContext, username, objUser1
 
Do
  strDomain = inputbox( "Please enter a domainname", "Input" )
Loop until strDomain <> ""
 
     'Finding our default naming context
    Set oRoot = GetObject("LDAP://rootDSE")
    strDefaultNamingContext = oRoot.Get("defaultNamingContext")
    Set oRoot = Nothing
 
 
ListUsers( strDomain )
 
Sub ListUsers( strDomain )
	Set objComputer = GetObject("WinNT://" & strDomain )
	objComputer.Filter = Array( "User" )
	
	
	For Each objUser In objComputer
 
		username = ""&objuser.name
	
            	If objUser.AccountDisabled = TRUE Then
 
			Set objUser1 = GetObject(getLdapUN(username))
			
			objUser1.PutEx ADS_PROPERTY_CLEAR,"manager",0
			objuser1.Setinfo
		End If
	Next
	
	MsgBox "The Script has finished working"
End Sub
 
'Function module for getLdapUN()
Function getLdapUN(strUN)
Dim oConnect, Command, strLdapQuery, Rs
getLdapUN = False
Set oConnect = CreateObject("ADODB.Connection")
Set Command = CreateObject("ADODB.Command")
'--- search for object in AD ---
strldapquery = "<LDAP://" & strDefaultNamingContext & ">;" & _
"(&(objectCategory=person)(objectClass=user)(sAMAccountName=" & _
strUN & "));ADsPath,cn;subtree"
 
oConnect.Provider = "ADsDSOObject"
oConnect.Open "Active Directory Provider"
Set Command.ActiveConnection = oConnect
Command.CommandText = strldapquery 'strSQL
Set Rs = Command.Execute 'Execute the query
 
'WScript.Echo "Records: " & Rs.RecordCount
If Rs.RecordCount > 0 Then
    getLdapUN = rs("AdsPath")
End If
 
Set oConnect = Nothing
Set Command = Nothing
End Function

Open in new window

0
 
LVL 71

Accepted Solution

by:
Chris Dent earned 2000 total points
ID: 24076278

If you're using the parts native to PowerShell (DirectoryServices) then....

Chris
# Create a search filter for disabled accounts with Manager still set
$LdapFilter = "(&(objectClass=user)(objectCategory=person)(userAccountControl:1.2.840.113556.1.4.804:=2)(manager=*))"
 
# Create a searcher for the current domain
$Searcher = New-Object System.DirectoryServices.DirectorySearcher($Null, $LdapFilter)
$Searcher.PageSize = 100
$Searcher.PropertiesToLoad.AddRange(@("distinguishedNamed", "manager"))
 
ForEach ($User in $Searcher.FindAll()) {
  $User = $User.GetDirectoryEntry()
  $User.PutEx(1, "manager", $Null)
  $User.SetInfo()
}

Open in new window

0
 
LVL 71

Expert Comment

by:Chris Dent
ID: 24076314

And if you happen to prefer to use Quest's tools...

http://www.quest.com/activeroles-server/arms.aspx

Then...

Chris

PS both of these options will leave you with the manager attribute unset (we're not inserting a blank value in its place)
Get-QADUser -Manager * -Disabled | Set-QADUser -objectAttributes @{manager=''}

Open in new window

0

Featured Post

[Webinar] Lessons on Recovering from Petya

Skyport is working hard to help customers recover from recent attacks, like the Petya worm. This work has brought to light some important lessons. New malware attacks like this can take down your entire environment. Learn from others mistakes on how to prevent Petya like worms.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I don't pretend to be an expert at this, but I have found a few things that are useful. I hope that sharing them here will help others, so they will not have to face some rather hard choices. Since I felt this to be a topic of enough importance and…
Are you an Exchange administrator employed with an organization? And, have you encountered a corrupt Exchange database due to which you are not able to open its EDB file. This article will explain all the steps to repair corrupt Exchange database.
Attackers love to prey on accounts that have privileges. Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…
Suggested Courses

636 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question