2

When an employee leaves our organizations for any reason, currently we disable their AD account but do not immediately delete it. However, the problem with this is that these users still show up in the Global Address List.

I'm sure there is a PowerShell script to remove them but I would like to make things more streamlined.

I'm hoping somebody here might be able to provide a better way to go about disabling users which will automatically remove them from the GAL in the process.

So far I can think of two potential solutions.

  1. Create a script that runs a PS script every hour that will remove disabled users from the GAL.

  2. Use a PS command that will simultaneously disable a user and remove them from the GAL.

Option 2 is likely the better option so if somebody could assist with that, I would greatly appreciate it.

Thanks in advance.

0
6

No need to re-invent the wheel, found this elegant solution over at petri.co.il:

# http://www.petri.co.il/forums/showthread.php?p=109975 
# usage: Disable-User [accountname] [enable/disable]

function get-dn ($SAMName)    {
    $root = [ADSI]''
     $searcher = new-object System.DirectoryServices.DirectorySearcher($root)
    $searcher.filter = "(&(objectClass=user)(sAMAccountName= $SAMName))"
    $user = $searcher.findall()

    if ($user.count -gt 1)      {     
            $count = 0
                foreach($i in $user)            { 
            write-host $count ": " $i.path 
                    $count = $count + 1
                }

            $selection = Read-Host "Please select item: "
        return $user[$selection].path

          }      else      { 
          return $user[0].path
          }
}

$Name = $args[0]
$status = $args[1]
$path = get-dn $Name

if ($path -ne $null)    {

    "'" + $path + "'"  
    if ($status -match "enable")     {
        # Enable the account
        $account=[ADSI]$path
        $account.psbase.invokeset("AccountDisabled", "False")
        $account.setinfo()
        Set-Mailbox "$Name" -HiddenFromAddressListsEnabled $False
    }    else    {
        # Disable the account
        $account=[ADSI]$path
        $account.psbase.invokeset("AccountDisabled", "True")
        $account.setinfo()
        Set-Mailbox "$Name" -HiddenFromAddressListsEnabled $True
    }
}    else    {
    write-host "No user account found!" -foregroundcolor white -backgroundcolor red
}

Save it as Disable-User.ps1 and run .\Disable-User.ps1 SAMaccountname disable

4
  • Awesome, thanks man. I'll give it a try and if it works, award the answer! Mar 8 '12 at 17:47
  • Works like a dream, thanks again for pointing me in the right direction. Mar 8 '12 at 18:00
  • NP. Thought about the Quest solution as proposed by smassey, but for the sake of portability I believe this is better Mar 8 '12 at 18:22
  • Upvote. Hide all of your disabled users from the GAL.
    – Tatas
    Mar 8 '12 at 18:43
6

There is an easier solution than the one above and can be accomplished in two lines when using the Quest AD PowerShell Commandlets in the Exchange Management Console.

param(
[string]$username = $(throw "A user ID is required.") #throw exception if no value provided
)

Disable-QADUser -Identity $username -service "dc.domain.local:389"
Set-Mailbox  -identity "domain\$username" -HiddenFromAddressListsEnabled $true -DomainController "dc.domain.local"
1
  • Powershell is the preferred method.
    – Tatas
    Mar 8 '12 at 18:43
0

There's a much easier way:

  1. Go to EMC > user mailbox > properties
  2. In the general tab you will see a check box hide from exchange address list, check this box.
  3. click apply

No one will be able to see that user in GAL after that.

0

Hide single users from the address list

A single user, which username is known, you can hide with this command:

Set-ADUser "your username" -Add @{msExchHideFromAddressLists="TRUE"}

This can be helpful if you created a script to disable former users. In this case you can pass the username in a variable.

0

Run from Exchange Management Shell:

Get-Mailbox -ResultSize unlimited |Where{($_.UserAccountControl -like “AccountDisabled*”)} | set-mailbox -HiddenFromAddressListsEnabled $true

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.