Avatar of jwcchelpdesk
jwcchelpdesk
 asked on

Removing Active Sync from disabled accounts

We are currently using Forefront Identity Manager to create\disable\delete accounts through the assistance of a 3rd party company that assists colleges for integration with Ellucian Banner. Anyway, we are coming across an issue that when FIM disables an account and tries to move it to our Disable Accounts OU, it is unable to do so. The common factor is these accounts have active sync on them.

The 3rd party company suggested to us that we manually delete the EAS from the disabled accounts. We can manually remove the EAS from the accounts, then FIM will move the account(s) to the proper OU on its next sync. However when more and more accounts have EAS, it seems counter-productive. My question to the Experts is this: is there a Powershell script that we can run that will remove all of the EAS from any disabled accounts so that FIM can move the accounts to the proper OU?  

Thanks!
ExchangeActive DirectoryPowershell

Avatar of undefined
Last Comment
jwcchelpdesk

8/22/2022 - Mon
Raheman M. Abdul

Make sure you get the list as intended for the disabled users by:

Get-Mailbox -resultsize unlimited | where { $_.ExchangeUserAccountControl -match 'AccountDisabled'}

Open in new window


If you are happy try this:

Get-Mailbox -resultsize unlimited | where { $_.ExchangeUserAccountControl -match 'AccountDisabled'} | Set-CASMailbox -ActiveSyncEnabled:$false

Open in new window


For all the mailboxes in a given OU:

Get-Mailbox -OrganizationalUnit [b]DisabledAccountsOU [/b]| Set-CASMailbox -ActiveSyncEnabled:$false

Open in new window

jwcchelpdesk

ASKER
Will this actually remove the EAS folder from their account in AD, or just disable it in Exchange? We need the folder deleted, then FIM can move the account.
EAS-folder-in-AD.PNG
Raheman M. Abdul

Try this: (Have not tried by myself now)
$devices = Get-Mailbox -resultsize unlimited | where { $_.ExchangeUserAccountControl -match 'AccountDisabled'}                                           
foreach ($device in $devices) 
{
  Remove-ActiveSyncDevice -Identity $device -confirm:$false
}

Open in new window

This is the best money I have ever spent. I cannot not tell you how many times these folks have saved my bacon. I learn so much from the contributors.
rwheeler23
jwcchelpdesk

ASKER
Here's the error message i receive when i run the above script to remove devices from accounts:

Remove-ActiveSyncDevice : Cannot bind parameter 'Identity'. Cannot convert the "<Name of User>" value of type "Microsoft.Exchange.Data.Directory.
Management.Mailbox" to type "Microsoft.Exchange.Configuration.Tasks.ActiveSyncDeviceIdParameter".
At C:\Scripts\ActiveSync\ActiveSyncRemoval.ps1:26 char:36
+   Remove-ActiveSyncDevice -Identity <<<<  $device -confirm:$true
    + CategoryInfo          : InvalidArgument: (:) [Remove-ActiveSyncDevice], ParameterBindingException
    + FullyQualifiedErrorId : CannotConvertArgumentNoMessage,Microsoft.Exchange.Management.Tasks.RemoveMobileDevice
jwcchelpdesk

ASKER
I think i have figured it out. I also want to be sure it outputs to a csv file which accounts EAS was removed from, but i think i may have my export in a wrong spot. Here is what i have:

#Variables
$FilePath = "C:\Scripts\ActiveSync\removed-eas.csv"
$OuDomain = "<OU location has been removed>"

$StaleDevices = Get-Mailbox -resultsize unlimited -OrganizationalUnit $OuDomain | ForEach {Get-ActiveSyncDeviceStatistics -Mailbox:$_.Identity} `
| where { $_.ExchangeUserAccountControl -match 'AccountDisabled'}  | select -expand Identity
foreach ($device in $StaleDevices) 
{
  Remove-ActiveSyncDevice -Identity $device -confirm:$true
}
| Select-Object DisplayName , Alias | Export-Csv $FilePath -NoTypeInformation

Open in new window

ASKER CERTIFIED SOLUTION
jwcchelpdesk

THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
GET A PERSONALIZED SOLUTION
Ask your own question & get feedback from real experts
Find out why thousands trust the EE community with their toughest problems.
jwcchelpdesk

ASKER
I posted my problem on EE, and another site, and between the two sites giving great help, i came up with the script.
⚡ FREE TRIAL OFFER
Try out a week of full access for free.
Find out why thousands trust the EE community with their toughest problems.