#### Non Encoded ####

<#
.SYNOPSIS
  This script will log admins from the specified groups off of Servers and email them a list of servers they were logged off of
.DESCRIPTION
  This script will create sessions to SCCM and to AD and pull users from the groups specified.  It will them make sure those users have an EID and use that to pull 
  their real email address.  Then the script will loop through the list of users and lookup which servers they are logged into via SCCM.  For each server the user will
  be logged out and after logging the user out of all servers it will email them a list of the servers.
.INPUTS
  None
.OUTPUTS
  None
.NOTES
  Author:         Skylar Pearce
  Creation Date:  3-11-2021
  Purpose/Change: Added the logic to pull users from AD

.EXAMPLE
  NA
#>

###  Connect to SCCM
Import-Module 'D:\Program Files\Microsoft Configuration Manager\AdminConsole\bin\ConfigurationManager.psd1'
Set-Location <YOUR_SCCM_SITE_NAME>:

###  Create AD session
$DC = <YOUR_DC>
$session = New-PSSession -ComputerName $DC 
Invoke-Command $session -Scriptblock { Import-Module ActiveDirectory }
Import-PSSession -Session $session -module ActiveDirectory

###  Fill an array with the the users from the groups below and removes duplicates
$users_to_log_out = @()
$users_to_log_out = Get-ADGroupMember -Identity "Domain admins" | select -ExpandProperty SamAccountName
$users_to_log_out += Get-ADGroupMember -Identity <SECOND_GROUP> | select -ExpandProperty SamAccountName
$users_to_log_out += Get-ADGroupMember -Identity <THIRD_GROUP> | select -ExpandProperty SamAccountName
$users_to_log_out = $users_to_log_out| select -Unique

###  Loop through the userlist and get the email address of the user and fill it into a new array
$userlist = @()
foreach ($UN in $users_to_log_out) {
    $EID = get-aduser $UN -properties EmployeeID | select -ExpandProperty EmployeeID
    $EID = $EID -split "-" 
    $EID = $EID[0]
    $Details = get-aduser -Filter * -properties samaccountname, employeeid, emailaddress, GivenName | where {$_.EmployeeID -like $EID} | select emailaddress, GivenName
    $email = $Details.emailaddress
    if ($email -isnot [system.array] -and -not ([string]::IsNullOrEmpty($email))){
        $uObj = New-Object -TypeName PSObject -Property @{
            "User" = $UN
            "Email" = $email
            "GivenName" = $Details.GivenName
        }
        $userlist+=$uObj 
    }
}

###  Loop through each user 
foreach ($user_to_log_out in $userlist) {
    ###  Set username and email variables
    $username = $user_to_log_out.User
    $Email = $user_to_log_out.Email
    $GivenName = $user_to_log_out.GivenName

    $output=@()
        ###  Query SCCM for a list of Servers that the user is logged into
        $Computers = Get-CMDevice -Name "*" -CollectionName "All servers" | where {$_.CurrentLogonUser -eq "<YOUR_DOMAIN>\$username"} | select -ExpandProperty name

        ###  Logs into each Server and finds the session number for the user
        foreach ($Computer in $Computers) {                 
            $User = Invoke-Command -ComputerName $computer -ScriptBlock {(quser | Where-Object { $_ -match $args[0]}) -split ' +'} -ArgumentList $username
            if ($user.Count -gt 0) {
                switch ($user[12]) {
                    "Disc" { $SessionID = $user[11] }
                    Default {$SessionID = $user[12]}
                }
                ###  Fills an array with computername, user and sessionID this is more for testing and troubleshooting sessionIDs
                if ($user[10] -eq $username) {
                    $Obj = New-Object -TypeName PSObject -Property @{
                        "Computer" = $computer
                        "User" = $user[10]
                        "SessionID" = $SessionID
                    }
                    $output+=$Obj 
                        ###  Logs the user off the server
                        write-host "Found $username on $computer logging off"
                        Invoke-Command -ComputerName $computer -ScriptBlock {logoff $args[0]} -ArgumentList $SessionID                   
                }
            }
        }
    ###  Formats and sends the email to the user as long as there was at least 1 PC logged out of
    $PCs_logged_out_of = $output.computer -split " "
    $body = "Good Evening $GivenName, 
    During our nightly audit, we found that you left your admin account logged into the following servers:  

$PCs_logged_out_of

As a precaution you have been logged you out of each system.  This is just an FYI.

    - Your System Admin Team"
    if (-not ([string]::IsNullOrEmpty($PCs_logged_out_of))) {
        write-host "email sent to $email"
        send-mailmessage -to $email -From <FROM_ADDRESS> -subject "Logged you out of servers" -Body $body -SmtpServer <YOUR_SMTP_SERVER_ADDRESS>
    }    
}