Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

When an employee leaves our organizations for any reason, currently we disable their AD account but do not immediately delete it. However, the problem with this is that these users still show up in the Global Address List.

I'm sure there is a PowerShell script to remove them but I would like to make things more streamlined.

I'm hoping somebody here might be able to provide a better way to go about disabling users which will automatically remove them from the GAL in the process.

So far I can think of two potential solutions.

  1. Create a script that runs a PS script every hour that will remove disabled users from the GAL.

  2. Use a PS command that will simultaneously disable a user and remove them from the GAL.

Option 2 is likely the better option so if somebody could assist with that, I would greatly appreciate it.

Thanks in advance.

share|improve this question
add comment

3 Answers

up vote 6 down vote accepted

No need to re-invent the wheel, found this elegant solution over at petri.co.il:

# http://www.petri.co.il/forums/showthread.php?p=109975 
# usage: Disable-User [accountname] [enable/disable]

function get-dn ($SAMName)    {
    $root = [ADSI]''
     $searcher = new-object System.DirectoryServices.DirectorySearcher($root)
    $searcher.filter = "(&(objectClass=user)(sAMAccountName= $SAMName))"
    $user = $searcher.findall()

    if ($user.count -gt 1)      {     
            $count = 0
                foreach($i in $user)            { 
            write-host $count ": " $i.path 
                    $count = $count + 1
                }

            $selection = Read-Host "Please select item: "
        return $user[$selection].path

          }      else      { 
          return $user[0].path
          }
}

$Name = $args[0]
$status = $args[1]
$path = get-dn $Name

if ($path -ne $null)    {

    "'" + $path + "'"  
    if ($status -match "enable")     {
        # Enable the account
        $account=[ADSI]$path
        $account.psbase.invokeset("AccountDisabled", "False")
        $account.setinfo()
        Set-Mailbox "$Name" -HiddenFromAddressListsEnabled $False
    }    else    {
        # Disable the account
        $account=[ADSI]$path
        $account.psbase.invokeset("AccountDisabled", "True")
        $account.setinfo()
        Set-Mailbox "$Name" -HiddenFromAddressListsEnabled $True
    }
}    else    {
    write-host "No user account found!" -foregroundcolor white -backgroundcolor red
}

Save it as Disable-User.ps1 and run .\Disable-User.ps1 SAMaccountname disable

share|improve this answer
    
Awesome, thanks man. I'll give it a try and if it works, award the answer! –  Windows Ninja Mar 8 '12 at 17:47
    
Works like a dream, thanks again for pointing me in the right direction. –  Windows Ninja Mar 8 '12 at 18:00
    
NP. Thought about the Quest solution as proposed by smassey, but for the sake of portability I believe this is better –  Mathias R. Jessen Mar 8 '12 at 18:22
    
Upvote. Hide all of your disabled users from the GAL. –  Tatas Mar 8 '12 at 18:43
add comment

There is an easier solution than the one above and can be accomplished in two lines when using the Quest AD PowerShell Commandlets in the Exchange Management Console.

param(
[string]$username = $(throw "A user ID is required.") #throw exception if no value provided
)

Disable-QADUser -Identity $username -service "dc.domain.local:389"
Set-Mailbox  -identity "domain\$username" -HiddenFromAddressListsEnabled $true -DomainController "dc.domain.local"
share|improve this answer
    
Powershell is the preferred method. –  Tatas Mar 8 '12 at 18:43
add comment

There's a much easier way:

  1. Go to EMC > user mailbox > properties
  2. In the general tab you will see a check box hide from exchange address list, check this box.
  3. click apply

No one will be able to see that user in GAL after that.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.