I am need of some assistance please. I am a system admin and I am trying to create a script that will assist with the tedious tasks I have to do with disabling a user that no longer works for the company.

I have created a script so far that will reset the users passwords and remove them from all groups (minus domain users).

I am trying to make it where it will deny permissions to logon to Remote Desktop Session Host server as well as give full mailbox permission to the manager in Exchange Server 2010.

I know with Exchange 2010, I will need to add the Powershell snapin. Is there a way for this to be added into the script? I am thinking to add the code:

add-pssnapin Microsoft.exchange.management.powershell.e2010

Is there another way to do this? Any help or recommendations would be much appreciated.

$ou = Get-ADUser -SearchBase "<*OU info here*>" -Filter * |
Set-ADAccountPassword -Reset -NewPassword (ConvertTo-SecureString -AsPlainText "<*Password here*>" -Force)
foreach ($user in $ou) {
$UserDN = $user.DistinguishedName
Get-ADGroup -LDAPFilter "(member=$UserDN)" | foreach-object {
if ($_.name -ne "Domain Users") {remove-adgroupmember -identity $_.name -member $UserDN -Confirm:$False} }
  • 2
    Why don't you just disable their user account and forget about flailing around with group membership, user rights, passwords, etc.? – joeqwerty Apr 24 '15 at 19:59
  • 2
    What do you mean by deny ability use remote desktop? Just remove them from the group that permits access. How are you permitting access to your session host servers in the first place? – Zoredache Apr 24 '15 at 19:59
  • We have a checklist we have to go through with the tasks listed. We have to keep to the account enabled until HR changes the status which is usually 30-90 days depending. Managers sometimes need to access the accounts to retrieve information, etc. – cpom1 Apr 26 '15 at 13:13
  • As an admin, I wonder why using script instead of GPO. "Deny log on remotely". If you want, there is also "deny log on locally". You can move these users to an dedicated OU or group, then apply the GPO to that OU or group – strongline Apr 27 '15 at 3:21
  • So basically I would create a GPO to do the task and apply it the particular OU? I guess I could do that. I still would like to know how to add the option in my script. Thanks for the suggestion. – cpom1 Apr 28 '15 at 13:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.