Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

Create a LDS Instance for Deleted User Accounts

Posted on 2014-09-01
9
Medium Priority
?
276 Views
Last Modified: 2014-10-20
Good morning experts, I have a rather bespoke query that I hope you can assist me with.

My client currently does not delete user accounts related to leavers and their Active Directory is populated with over 1,000 disabled accounts for old users that have since left the organisation. They have decided that they want to start deleting the accounts when the user(s) leave the organisation however they are concerned that they may, at some point in the future, need to know various snippets of information about one or more deleted users (stuff like email address, manager, profile, home drive etc.).

They have set their mind on having this store in a LDAP/LDS Instance...so this is where your collective brains may be able to help.

I need to create a powershell script that will extract deleted USERS from AD, dump them to a file and the file is then used to populate the LDS instance with this information.

Any advice, comments etc. are most welcome.

Rgds
FMcFF
0
Comment
Question by:Darren Reevell
  • 6
  • 3
9 Comments
 
LVL 29

Expert Comment

by:Dan McFadden
ID: 40303258
First a few questions:

1. What Server OS on the DCs?
2. What is the Forest/Domain function level?
3. Is the AD Recycle Bin enabled?
4. If no AD Recycle Bin, how are accounts determined to be "deleted?"

Dan
0
 
LVL 1

Author Comment

by:Darren Reevell
ID: 40303410
Dan,

Thanks...answers below:

1. What Server OS on the DCs? Win 2008 R2
2. What is the Forest/Domain function level? Windows 2008
3. Is the AD Recycle Bin enabled? Yes
4. If no AD Recycle Bin, how are accounts determined to be "deleted?" See previous answer

Rgds FMcFF
0
 
LVL 29

Expert Comment

by:Dan McFadden
ID: 40303672
More questions...

1. Is the implementation of this process set in stone already?
2. Do they desire to maintain group memberships as well?
3. Have they already started to delete these accounts?
4. Do they have a data retention policy?

Reason for asking... you can set the data retention policy on the AD Recycle Bin.  The default is 180 days.  You can use PowerShell to create a simple report of the user objects in the Bin.  If they needed to review a deleted user object, you can output the attributes using a similar script.

Dan
0
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 
LVL 1

Author Comment

by:Darren Reevell
ID: 40303696
sounds interesting, can you expand a little more on how I create the report and the sort of information the report can contain? Or...point me towards a KB..

Thanks
0
 
LVL 29

Expert Comment

by:Dan McFadden
ID: 40303732
Sample script for pulling a list of deleted user objects in the AD Recycle Bin:

Get-ADObject -SearchBase "CN=Deleted Objects,DC=<YourDomainName>a,DC=<YourExtension>" -Filter {objectClass -eq "user" -and objectclass -ne "computer"} -includeDeletedObjects -Properties DisplayName,mail,department,title | ft ObjectGuid,DisplayName,mail,department,title -auto

Open in new window


To see the info available on a deleted user object in the Bin:

Get-ADObject -SearchBase "CN=Deleted Objects,DC=<YourDomainName>,DC=<YourExtension>" -Filter {CN -like "*<YourLastName>*"} -includeDeletedObjects -Properties *

Open in new window


You could generate a daily/weekly/etc report with the first command and use the second command to get the info someone wants to know.

Dan
0
 
LVL 29

Expert Comment

by:Dan McFadden
ID: 40303739
They first command can be enhanced to pull more fields but you would want to export it to a CSV.
0
 
LVL 29

Expert Comment

by:Dan McFadden
ID: 40311706
Any additional thoughts or updates?
0
 
LVL 1

Author Comment

by:Darren Reevell
ID: 40311715
Sorry...been looking at other service issues for the last few days. Will be revisiting this again later this week and I'll update accordingly.

Thanks for you help thus far.
0
 
LVL 29

Accepted Solution

by:
Dan McFadden earned 2000 total points
ID: 40355864
Did any of this help out?
0

Featured Post

Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A recent project that involved parsing Tableau Desktop and Server log files to extract reusable user queries for use in other systems. I chose to use PowerShell to gather the data, and SharePoint to present it...
In previous parts of this Nano Server deployment series, we learned how to create, deploy and configure Nano Server as a Hyper-V host. In this part, we will look for a clustering option. We will create a Hyper-V cluster of 3 Nano Server host nodes w…
This tutorial will walk an individual through the steps necessary to enable the VMware\Hyper-V licensed feature of Backup Exec 2012. In addition, how to add a VMware server and configure a backup job. The first step is to acquire the necessary licen…
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an antispam), the admini…

810 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question