Removing Active Sync from disabled accounts

We are currently using Forefront Identity Manager to create\disable\delete accounts through the assistance of a 3rd party company that assists colleges for integration with Ellucian Banner. Anyway, we are coming across an issue that when FIM disables an account and tries to move it to our Disable Accounts OU, it is unable to do so. The common factor is these accounts have active sync on them.

The 3rd party company suggested to us that we manually delete the EAS from the disabled accounts. We can manually remove the EAS from the accounts, then FIM will move the account(s) to the proper OU on its next sync. However when more and more accounts have EAS, it seems counter-productive. My question to the Experts is this: is there a Powershell script that we can run that will remove all of the EAS from any disabled accounts so that FIM can move the accounts to the proper OU?  

Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Raheman M. AbdulSenior Infrastructure Support Analyst & Systems DeveloperCommented:
Make sure you get the list as intended for the disabled users by:

Get-Mailbox -resultsize unlimited | where { $_.ExchangeUserAccountControl -match 'AccountDisabled'}

Open in new window

If you are happy try this:

Get-Mailbox -resultsize unlimited | where { $_.ExchangeUserAccountControl -match 'AccountDisabled'} | Set-CASMailbox -ActiveSyncEnabled:$false

Open in new window

For all the mailboxes in a given OU:

Get-Mailbox -OrganizationalUnit [b]DisabledAccountsOU [/b]| Set-CASMailbox -ActiveSyncEnabled:$false

Open in new window

jwcchelpdeskAuthor Commented:
Will this actually remove the EAS folder from their account in AD, or just disable it in Exchange? We need the folder deleted, then FIM can move the account.
Raheman M. AbdulSenior Infrastructure Support Analyst & Systems DeveloperCommented:
Try this: (Have not tried by myself now)
$devices = Get-Mailbox -resultsize unlimited | where { $_.ExchangeUserAccountControl -match 'AccountDisabled'}                                           
foreach ($device in $devices) 
  Remove-ActiveSyncDevice -Identity $device -confirm:$false

Open in new window

Big Business Goals? Which KPIs Will Help You

The most successful MSPs rely on metrics – known as key performance indicators (KPIs) – for making informed decisions that help their businesses thrive, rather than just survive. This eBook provides an overview of the most important KPIs used by top MSPs.

jwcchelpdeskAuthor Commented:
Here's the error message i receive when i run the above script to remove devices from accounts:

Remove-ActiveSyncDevice : Cannot bind parameter 'Identity'. Cannot convert the "<Name of User>" value of type "Microsoft.Exchange.Data.Directory.
Management.Mailbox" to type "Microsoft.Exchange.Configuration.Tasks.ActiveSyncDeviceIdParameter".
At C:\Scripts\ActiveSync\ActiveSyncRemoval.ps1:26 char:36
+   Remove-ActiveSyncDevice -Identity <<<<  $device -confirm:$true
    + CategoryInfo          : InvalidArgument: (:) [Remove-ActiveSyncDevice], ParameterBindingException
    + FullyQualifiedErrorId : CannotConvertArgumentNoMessage,Microsoft.Exchange.Management.Tasks.RemoveMobileDevice
jwcchelpdeskAuthor Commented:
I think i have figured it out. I also want to be sure it outputs to a csv file which accounts EAS was removed from, but i think i may have my export in a wrong spot. Here is what i have:

$FilePath = "C:\Scripts\ActiveSync\removed-eas.csv"
$OuDomain = "<OU location has been removed>"

$StaleDevices = Get-Mailbox -resultsize unlimited -OrganizationalUnit $OuDomain | ForEach {Get-ActiveSyncDeviceStatistics -Mailbox:$_.Identity} `
| where { $_.ExchangeUserAccountControl -match 'AccountDisabled'}  | select -expand Identity
foreach ($device in $StaleDevices) 
  Remove-ActiveSyncDevice -Identity $device -confirm:$true
| Select-Object DisplayName , Alias | Export-Csv $FilePath -NoTypeInformation

Open in new window

jwcchelpdeskAuthor Commented:
Had to modify my script to get it working, but here's the final script that will remove EAS Devices from Disabled Accounts in a certain OU, then output the display name and alias to a CSV file.

$FilePath = "C:\Scripts\ActiveSync\removed-eas-students.csv"
$OuDomain = "  "

$EASDevices = Get-Mailbox -resultsize unlimited -OrganizationalUnit $OuDomain | `
Where-Object {$_.ExchangeUserAccountControl -match 'AccountDisabled'}

ForEach($mailbox in $EASDevices) {
	Get-ActiveSyncDevice -Mailbox $mailbox.Identity |`
	Remove-ActiveSyncDevice -Confirm:$True

$EASDevices | Select-Object DisplayName , Alias | Export-Csv $FilePath -NoTypeInformation

Open in new window

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
jwcchelpdeskAuthor Commented:
I posted my problem on EE, and another site, and between the two sites giving great help, i came up with the script.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.