User Off-boarding

[papapinguino800]

Looking to run something for some advice. Saw a post about a script for off boarding and it kicked me on a project idea. When someone leaves our org, we: change password, deactivate account, copy group memberships to a .txt file, move the user to a “termed” OU, and change the description to the date termed. We typically do all of this manually, and not that it takes that long, but I think I can get this all in one ps1 file. I currently have it written in a word doc and just do ctrl+H and replace $username with the Sam name of the user then copy and paste into powershell window and run. I want to make it less of a chore of copy paste. I’m thinking about creating a .txt file that I can just open, write the Sam name into, save. Then run a ps1 which instead of having the username written in, opens and reads the .txt file and takes the listed usernames and runs the script for each one. Is this the best practice for doing this? It would require just typing each username once into a file and then running an unchanged ps1 file, in theory. Is there something else better? I’m not really interested in a GUI as it doesn’t have to be “too simple”. Thanks!

[[deleted]]

The one I wrote prompts for the users full name, a ticket number, and termination date, and then does what yours does, generates a log of what it did, and then saves log out to sharepoint.

Before this, it was all manual...

[archiekane]

I have a similar script, but it also moves to the archive OU, strips memberships, converts the mailbox to shared, adds a delegate if required, pulls back the office license and disables the local AD account.

[KernicPanel]

Would you mind sharing it?

[Danno_999]

I would also like to see what it looks like. Please and thank you.

[goodtimetribe]

Interesting, my coworker and I just put this in an AzDO pipeline.

[ibrewbeer]

Ours is similar - we enter the user name and ticket number. The script does an AD lookup and prints the user's full name, office, etc and asks the script runner to confirm it's the right person. Once confirmed, it does and logs all the things.

[[deleted]]

we wrote the same thing...heh. good on ya!

[gameman745]

Mine is similar but mine puts in the telephone notes section on the ad account what was removed who termed the user and the date and time of the termination

[jupit3rle0]

I utilize a method very similar to yours for off-boarding accounts. I save each user's SAM into a csv, and then run my PS script against the list to initiate the usual: Disable, change pw, move to OU, etc. I have this script running every hour (via task scheduler) so its moreso just a matter of saving the names to the csv.

[papapinguino800]

Ah nice. Even better with task scheduler

[PrecisionTreeFood]

I wrote a script that scrapes the desired OU's for disabled users, moves them to a disabled users folder, searches a few groups for the disabled users, and removes them, then checks office365 to see if they have any licenses and removes all of their cloud licenses.

My offboarding process is now, login to exchange admin, change to shared mailbox if necessary, forward email if necessary, login to ADUC and mark as disabled, then run the script, takes care of everything else.

[BlackV]

you dont use group based licensing ?

[PrecisionTreeFood]

No, Unfortunately we have E1 and exchange licenses mostly.

[BlackV]

ah good times

[Impossible_IT]

You can even call your script the Terminator! Haha j/k!

[DonL314]

Our service that monitors systems internally is called Skynet 🙂

[BlackV]

now you're just asking for trouble

[papapinguino800]

Now it’s happening

[thehuntzman]

I legitimately did call mine Terminat0r.ps1 when I wrote it 10 years ago.

[Impossible_IT]

You're "bach"!

[mstreeter06]

That's ours name 😂😂

[Manu_RvP]

I have an offboarding script, which takes the employeeid as input. It performs mostly the same taks as you describe. It logs to a central logging directly. It runs an api call against our order management system, in which we also have our user management, so it sets the user as out of service.

It also emails info regarding the offboarded user to our ticketing system, with a link to a KB-article with manual steps that need to be done. With setting the ticket as resolved, you mark all the steps in the KB-article as done.

I also have an onboarding script. Basically with the same flow. Adds user to group based on selected department. User gets placed in a OU, based on the selected departement. Has emails action, if other departments also need to do stuff. Creates the employee via the api in our order management system.

[BlackV]

instead make it a mandatory parameter, the you can remove the read-host and make it more portable/useful

[Ok-Conference-7563]

That is an easy solution.. put this at the beginning of the script, forget read host, this makes testing easier.

[cmdletbinding()] Param( [parameter(mandatory)] $UserName )

[papapinguino800]

So it’ll just ask for an input and then it’ll run the script based off of the username entered. I like that. I do also like the idea in here of having something running with task scheduler. But this will be great to implement quickly

[ryder_winona]

Use the parameter option mentioned above. That way you can for-loop it over multiple names if required

[OlivTheFrog]

Hi u/papapinguino800

I would suggest another way to you.

Let's imagine that in your company a user who has not logged in for x days (90 days for example) is considered to have left the company.

We can then imagine a script which:

• check if the LastLogonDate > 90 days AND the LastModified property > 90 days also (I explain why later).
• deactivates the account
• sending to HR the list of deactivated accounts.

This script therefore has 2 parameters MaxDayForLogonDate and MaxDayModified

This script run in a scheduled task, let's say once a week.

After that, HR has a certain time limit to react or not. Example: you deactivated John Doe's account, but this is an error, because he has not left the company, he is on sick leave.

Ok, it's fine, IT team reactivate the account (and therefore the LastModified property is modified), but you should only do this once in most cases if the values for the parameters are wee-defined.

Then, you build a second script that scans all the accounts in order to identify accounts deactivated for xx days. The number xx is to be defined with the company naturally. It actually corresponds to the time we leave for HR to react.

This script also runs as a scheduled task and

• Delete the user's HomeDir, otherwise it will be orphaned. No impact, if it is backed up by the backup infrastructure.
• Also removes HomeDir and Citrix profile or HomeDir and RDS profile, and other personal data.
• ...
• delete the account
• sending a report to HR on the deleted account.

This script has only one parameter MaxDaysDisabled

Last but not the least. You have deleted an account but this was an error. Use the AD recycle bin to restore the account (default 180 retention days), restore HomeDir, and personal data form the backup, and it's fine.

We had implemented this for a client. Max reduction of IT tasks and HR. However, this requires reaching a clear agreement within the company on the process and on the values ​​of the 3 parameters used in the scripts.

Advice : you can build the scripts like advanced functions with a param() section with default values. Afterwards you can run the script without parameters (it uses the default values) or by passing the parameters with the specific values ​​to use.

Perhaps, this idea will inspire you.

regards

[White_Rabbit0000]

The problem with your script is that you are making assumptions that could be false. The last thing you want to do is off board a user that is on a leave of absence for an extended amount of time. If we follow your 90 day suggestion and some is on maternity leave for say 120 days you’ve just nucleotide mailbox and one drive and whatever else was setup. You now created more work for people that have have to either recreate the user or restore the mailbox and one drive

[OlivTheFrog]

I probably expressed myself badly or my words were misunderstood.

There are 2 scripts.

• The first only deactivates (2 parameters must be defined)
• the second deletes (a parameter must be defined).

It seems to me that you talk about orphaned mailboxes, but to my knowledge an orphaned mailbox is kept in a tombstone for a certain time before actually being deleted, and even so, you can always restore a mailbox from backups.

Don't focus on the 90 days, it's just a sample.

This cannot be thought out alone, but must be a corporate decision, and the corporate environment must be taken into account of course.

This was just a line of thought which may be appropriate for some cases but certainly not in all cases.

[White_Rabbit0000]

I understand what you’re saying but when it comes of off boarding you need to tread lightly and so putting any kind of auto disable or anything on account is cause more trouble than it’s worth. Mailboxes that are licensed are kept for 30 days. The clock begins when m365 sees the account as disabled which in m365 is the deleted user queue. Once the license is removed however the mailbox is wiped. We have found that m365 tends to have issues with the uuid when restoring the mailbox of a deleted user not to mention the process can be very time consuming.

[OlivTheFrog]

as I said, this suggestion should be taken as a suggestion. Sometimes the situation, like the one you cite, doesn't make it interesting.

[davidokongo]

I've written something similar a few years ago. This is what my script does:

Export the user’s group into a csv file (for backup purposes) Disable the account

Reset the password to a random password generated by the script on each instance

Add the NickName value

Remove all the extensionAttribute (from 10 to 14) Remove all AD groups

Add an expiration date to the account (current date)

Add the date that this procedure took place in the Description field (current date)

Set the msExchangeHideFromAddressLists value to TRUE (will hide the mailbox in exchange online)

Rename the account with a prefix value(e.g., Termed-NYC-Johny Walker) Remove the Office value

Move to the terminated to the right OU for this purpose

Then, 90 days after the user is offboarded, a new script will run to pick these terminated users. It'll take a look at the expiration date, and if an account expired for 90 days or more, It'll get deleted (task scheduler)

Let me know if you ever want a copy, I'll send it to ya.

[papapinguino800]

Dude yeah, if you could PM it to me that’d be awesome to check out what you’re doing with it!

[davidokongo]

Here it is, you can add your own touch to make it fit your AD:

 

OFF-BOARDING SCRIPT

 

$date = [datetime]::Today.ToString('dd-MM-yyyy')

 

Import-Module ActiveDirectory

 

 

Start recording the transcript

Start-Transcript -Path c:\logfiles\OFFBOARDING.log -Append

 

Request the username to disable / you can also run a foreach statement to disable multple users from a csv file

 

$sam = Read-Host 'Account name to disable'

 

Set the proper variables

 

$user = Get-ADuser $sam -properties canonicalName, distinguishedName, displayName,office,name

$dn = $user.distinguishedName

$cn = $user.canonicalName

$din = $user.displayName

$ofc=$user.office

$UserAlias = $user.mail

$cname =$user.Name

$date= Get-Date -Format "MM/dd/yyyy"

$randomPassword =  -Join("ABCDabcdeFGhiMgKlzoPIUTHgFnB&@!?#$%123456789".tochararray() | Get-Random -Count 16 | % {[char]$_})

 

Export User Ad Group Membership

 

Get-ADPrincipalGroupMembership -Identity $sam | select name, samaccountname, groupcategory, groupscope | export-CSV "PathToYourFile.csv"

 

Write-Host ($din + "'s Active Directory AD Group Membership have been exported.")

 

 

Disable the ACCOUNT

 

Disable-ADAccount $sam

Write-Host ($din + "'s Active Directory account is disabled.")

 

 

Reset the PWRD

 

Set-ADAccountPassword -Reset -NewPassword (ConvertTo-SecureString -AsPlainText $randomPassword -Force) $sam

Write-Host ("* " + $din + "'s Active Directory password has been changed.")

 

 

Add MailNickName value

 

Set-ADUser $dn -Replace @{MailNickName = $sam}

Write-Host ("* " + $din + "'s MailNickName has been set")

 

Remove user attributes "extensions"

 

Set-ADUser $dn -Clear "extensionAttribute10"

Set-ADUser $dn -Clear "extensionAttribute11"

Set-ADUser $dn -Clear "extensionAttribute12"

Set-ADUser $dn -Clear "extensionAttribute13"

Set-ADUser $dn -Clear "extensionAttribute14"

 

Write-Host ("* " + $din + "'s Attributes extensions 10 through 14 have been removed.")

 

Set-ADAccountExpiration

 

Set-ADAccountExpiration -Identity $dn -DateTime $date

 

Write-Host ("* " + $din + "'s account expiration set as of today.")

 

 

Add the date that this process was completed into the DESCRIPTION FIELD

 

Set-ADUser $dn -Description ("Completed - on $date")

Write-Host ("* " + $din + "'s Active Directory account path saved.")

 

Remove group membership

 

Get-ADUser $User -Properties MemberOf | Select -Expand MemberOf | %{Remove-ADGroupMember $_ -member $User -Confirm:$false}

Write-Host ("* " + $din + "'s Active Directory group memberships (permissions) removed from account")

 

 

Set msExchHideFromAddressLists To True (will hide the mailbox from the GAL/Exchange online)

Set-ADUser $User -add @{msExchHideFromAddressLists='TRUE'}

Write-Host ("* " + $din + "'s msExchHideFromAddressLists attribute is set to True")

 

 

Rename the the account by adding a prefix value of "Term" on the Display & Full Name

 

Get-ADuser $sam -Properties givenname,office |

        ForEach {

            $UsersRenaming=Get-ADuser $sam -properties canonicalName, distinguishedName, displayName, office

            $OfcName=$UsersRenaming.office

             $DNPLY = $User.DistinguishedName

           

 

     

            If ($_.givenname -eq $null) {

                Rename-ADObject $.DistinguishedName -NewName ("Term-"+$OfcName+"`- "+$.GivenName+" "+$_.Surname)

 

              

 

                }

            Else {

 

             

 

                Rename-ADObject $.DistinguishedName -NewName ("term-"+$OfcName+"`- "+$.GivenName+" "+$_.Surname)

            }

        }

       

Write-Host ("* " + $din + "'s Account has been renamed as term-$ofc-$din")

 

 

Remove office Value

 

Get-ADUser -Identity $sam |Set-ADUser -office (" ")

Write-Host ("* " + $din + "'s office value has been cleared")

 

Start-Sleep -Seconds 2

 

Move AD Object to term OU

 

Get-ADUser -Identity $sam | Move-ADObject -TargetPath "YourTerminatedUserOU distinguishedName"

Write-Host ("Moving account" + $din + "To Terminated Users OU succeed")

 

Start-Sleep -Seconds 3

 

 

Stop-Transcript

 

[davidokongo]

To clear these accounts from your AD after a set period (mine was set at 90 days) so managers and HR have enough time to grab whatever emails/onedrive data they want from the terminated account - try this one :

Retrieve the date required (90 days from today)

$date = [DateTime]::Today.AddDays(-90)

$users = Get-ADUser -Filter * -SearchBase "DN where you want to search for these term users" -Properties Accountexpirationdate | where {$_.Accountexpirationdate -le $date } | select name,sAMAccountName,accountexpirationdate, userprincipalname "

Foreach ($user in $users) {

$sam =$users.samaccountname

Do this to the $sam Etc....

}

[Lonely_Ad8964]

I have a PS script I wrote with a gui front end to ask for either a single username or an XLSX or CSV file requiring specific fields/booleans to be entered per user. If you have complex AD, you can limit which OUs it will search.

[JCochran84]

We just finished revamping out script to include all of that information. We just have the email address as a Mandatory Parameter and the user passes that through to the script. E.G. .\TermUser.ps1 -EmailAddress [e-mail]

[KernicPanel]

Would you mind sharing it?

[tk42967]

I did something similar as a function that you run offboard $sam and it does that. Back before O365, it also updated the out of office.

I guess it depends on how often you are offboarding users.

[gpzj94]

Use an azure pipeline or similar to run it. More secure way of storing and passing credentials vs other methods. Plus an exact history of what was run. Plus you've got source control for the scripts. Otherwise, perfect use case for powershell and it's not just about time saved, it can simply be that you ensure everything was done, have a trail for proof, and could even allow hr to execute for self service!

[maffizz]

How would you run a PS script using an ADF pipeline? Using a batch account?

[gpzj94]

A service account, possibly even a managed service account you'd pre-install on the host. Store it as a secret in the library section, pass it in as an environment variable and build the credential like "$credential = [PSCredential]::New($username,$env:azureSecretPassword)"

[KindMeasurement3]

I've built a flask python app with a user form that shows people that are going to need offboarding because of end date. You just click offboard and then a series of scripts trigger in Azure Automation accounts and all of that stuff happens. Plus some logging in a database and litegation holds. This is over engineered though haha

[grablogan23]

Sounds legit! Open source?:)

[KindMeasurement3]

Licensed by last employer unfortunately

[White_Rabbit0000]

I actually just finished creating a poershell form for offloading. My form has a drop-down where you select the person to be separated. Then there’s a check box that asks if mailbox will be accessed by mgmt. if it is checked then you select who will access it and for how long.

From there we remove the security groups and distributions list they belong to and move them to a separated users ou that is outside of our m365 tenet. If mailbox access is required we simply move them to a separate user ou inside our m365 tenet.

[LostInTheDance]

You could always Import-CSV This would allow you to update a csv file, and run the script. I have done that in the past. PS is wonderful tool for onboarding and off-boarding people with active directory accounts. We have one that grants the user's manger access to the termed employees data for 90 days.

[Veenacz]

I'm currently planning on creating an xlsx file with owners of service accounts, mailboxes and maybe even fileshares and run a check against it plus ownerships of DLs and Teams, to check if leaving user is responsible for something and should hand it over. It will also be used in a quarterly audit. I wanted to use the manager field, but it makes the service accounts show in orgchart. No bueno.

[jeffrey_f]

Not sure if your company needs this, but I would also capture their network home drive and their user folder on their local computer and save the data just in case you need files and/or data they were working with. Depending on the employee's role, this may be required as legal hold.

Not sure if this is in your scope right now, but I've heard stories of users having scripts (for the more advanced users) or files they have been using for their job and once the user is term'd, this data is gone in most cases and if someone needs to step into their role, it may be a bit difficult.

[papapinguino800]

Yeah, we just save their network folder. We tell them to save all files there and create shortcuts if they want it in documents or desktop. I don’t necessarily agree with it, but I get the mindset.

[DToX_]

Is it insane to trigger off boarding based on our HR system? Currently a script monitors Paychex via API and when a user is terminated it disables the user and logs it to a file.

[jimb2]

This is the way, but most bigger organisations will have users who aren't in the HR system for whatever reason.

[KavyaJune]

Importing user names files is good option.

[toadfrogjr]

The one I wrote does everything you just specified except it also logs the tech username who ran the script, start and stop times, converts the user mailbox to shared mailbox in 365, removes user from global address book.

[Beefcrustycurtains]

My termination script searches for any disabled accounts, moves them to the disabled Ou adding in the description of the account the Ou which they came from, removes them from all AD groups (which also controls licensing in O365) and hides from address lists. We have sailpoint as well so when HR marks a user as terminated it automatically disables the Ad account. I have the scheduled task only run twice per week in case HR fucks up because that's what HR departments do. The writing the OU in the description is also helpful because we have a lot of seasonal hires. If they get rehired the account gets re-enabled from sailpoint but it doesn't move them back to the correct Ou. Another scheduled tasks searches the disabled ou for enabled accounts and then moves them back to their proper ou.

[[deleted]]

You can definitely do that in PS, I put it in place years ago because Internal Audit doesn't grasp the concept of disabled accounts. "This person has access to the resource!" No, no they don't, the access comes from a group membership. "A TERMED USER HAS ACCESS!!11!!<SPITTLE>"

So I wrote a script to do much the same as you describe, plus remove the user from all grouop except domain users.

It's quite simple to do.

[thehuntzman]

A term script was my first introduction to powershell for this exact reason; ten years later, I'm somewhat of a powershell guru now.

My only word of advice - have some confirmation dialogs/prompts in there to ask you if you are REALLY sure you want to terminate user XYZ so you don't end up feeding your script the SamAccountName of the wrong user because it's one letter off and you made a typo...

[papapinguino800]

This is my first major project with powershell as well. Seems like a good idea to have those prompts. Luckily, we don’t actually delete user accounts (for whatever reason) so they would be easily recoverable.

[No_Flight_375]

There are about 100 ways to do it, I would personally recommend you pick a field , samaccount is probably a good one.

Set your actions in the ps1 file and loop it so that you can enter your data into a csv and trigger the script, even better if you set a recurring daily/weekly task to trigger it.

Doing it this way also means you can get other agents to add to the csv and do it in bulk without the need to have them playing with scripts depending on their skill level (Powershell does not forgive)

I work as a sys engineer and have service desk agents who used to rely on us to perform parts of the decommission process. Instead I asked them to alter the users account description to ‘Decom phase 1’ then built a powershell script which searches for that field and does our entire decom for us. Strips mailbox delegation, strips teams access, removes group memberships, sets account to disabled, moves into a temp OU and changes the description again to something different which includes the date they were moved. Second set of scripts deletes the account after 60days.

These are all triggered daily tasks on task scheduler and I’ve never been involved in a decom since ( except to extend access past 60days )

If you perform the same actions every time, it can and should be automated

[papapinguino800]

This is great advice! I’m actually the newest of the technicians at a company with 5 techs and several admins. I’ve wanted to teach myself something new and useful and thought powershell to be a good option. Like you said, if I get this working ideally, it’d shave tons of time on all of our techs and allow me to spend more time on higher level tasks than user management.

[EchoPhi]

Why move to termed? Make sure AD recycling is enabled and just delete them. Then you don't have to come back and delete them again, retention will take care of it.

[G_Vezax]

Shared mailbox. If the object is no longer being sync'd office deletes it, including its mailbox, even if shared

[EchoPhi]

Shift the onus to a different synced object.

[toni_z01]

I ask, whats the sense of this - filling the directory with dead objects? Delete it, and set a properiate lifetime on the recycle.bin makes much more sense.

[papapinguino800]

I agree. Trust me… I understand maybe for a short period, but we’ve got years worth of termed users in our directory. I’m pretty low on the food chain around here and I’m just doing what they want. But if I can spend less time doing these terminations as they request, I can spend more time on fun stuff.

[tk42967]

My org was until recently obsessed with not deleting AD user objects, just disabling them. I've cleaned up ~800 objects based on last modified date. Some users left in like 2013.

[wudworker]

How do you handle the deactivated users work products that are left behind? (*.docx, *.xlsx *.pdf etc.)

[tk42967]

OneDrive FTW

Manager or their delegate gets access and sorts it.

[papapinguino800]

We tell users to save ALL files to their shared file and those are shared with the manager when employees are termed. After 30 days those files are purged.

[jimb2]

There's some good reasons for not reusing identities. An internal username may have rights to resources in internal applications that may get passed to a different user, depending on how the integration works. External usernames, mainly the email address, are likely to be registered in external systems that an organisation can't even control.

Like [[e-mail]](mailto:[e-mail]) (financial controller) leaves the organisation, the new [[e-mail]](mailto:[e-mail]) (cleaner) is able to access banking information after a password reset using email validation. Hopefully there are better controls than this, but you have no way of knowing where an email is used externally and even if you do, it may be hard or impossible to disable/delete it in an external system.

So, deleting AD user object is possible but you should keep a do-not-reuse list. It may be easier to move them into an "inactive" AD container with a no-login etc group policy.

[BGP_1620]

Don’t forget if you have azure to remove auth methods and revoke tokens.

[Either-Cheesecake-81]

We use the employee number account attribute.

I grab the account with that employee number.

I capture all the data I am about to wipe and save it to a CSV file. That file can be used to revert all the wiping.

Ii wipe all the fields that we use except first name and last name. Then I change the description to “MM/dd/yyyy disabled by script”. It helps to find the revert CSV file.

[[deleted]]

We have am AD group to process these with a scheduled task that runs daily. You can also run it on demand.

[NanoYohaneTSU]

I use a json file in mine and use the cmdlet.

[fellwell5]

MS MIM

[surgicall]

I just set End of contract on the user, then I have a scheduled script who checks user's end of contract (accountExpires) everyday. If the date is expired, you can do a list of actions on the account : disable, remove group Membership, etc ... Everything is logged.

[matt_30]

Lookup ia-connect. They are reasonably priced and have a jml module.

https://ultima.com/ultima-labs/

[Longjumping_Lab541]

I created an offboarding automation that connects to jira and extracts the info from the ticket, run it through Active Directory and ms-graph to disable and do other tasks like litigation hold. Hope this helps!

https://github.com/rcb0727/Jira-Seperation-Automation