Disable user via Csv if EmployeeID matches

Question

Hello,

We are currently trailing Adaxes before purchase, We want to use this to mainly automate our starters and leavers process. Starters seems easy enough, however I am looking for some help with disabling accounts.

The employee ID feild is complete for all of our users in AD and is our main key identifier. Our HR system will provide us with a CSV from which we would like to check that the employee ID matches the user in AD before proceeding to disable the account.

CSV
EmployeeID,Name,Surname,Operation
1234,Joe,Bloggs,Disable

From this we would like to check that the name and emplyee ID are a match then disable that account, if the name and employee are not a match then abort the operation. I assume powershell would be the way forward to do this as a scheduled task to process the CSV.

Not very experienced with powershell so any help would be much appreciated.

Regards

Answer 1

Hello Wayne,

Have a look at the following tutorial: https://www.adaxes.com/tutorials_Active ... romCSV.htm.

Comments

Hi,

Thanks for the response, I have the import of users working fine. I need something for disabling accounts.

Im guessing a business rule that checks the ID matches before disabling and then a scheduled task to run more powershell to actually process the CSV and disable the account?

I found this pit of Powershell below but this does not check the employee ID which is the only unique identifier between AD and our HR system. Had to # out the delete line as we do not want to delete.

Import-Module Adaxes
$csvFilePath = "C:\User Imports\Disable User.csv" # TODO: modify me
function ExecuteOperation ($username, $operationType)
{
    switch ($operationType)
    {
    #    "Delete"
    #    {
    #        # Try to delete the user
    #        try
    #        {
    #            Remove-AdmUser -Identity $userName -AdaxesService localhost -ErrorAction Stop -Confirm:$False
    #        }
    #        catch
    #        {
    #            return "Error: User '$userName' was not deleted. Error message: " + $_.Exception.Message
    #        }
    #        return "User '$userName' deleted successfully."
    #    }
        "Disable"
        {
            # Try to disable the User
            try
            {
                Disable-AdmAccount -Identity $userName -AdaxesService localhost -ErrorAction Stop
            }
            catch
            {
                return "Error: User '$userName' was not disabled. Error message: " + $_.Exception.Message
            }
            return "User '$userName' disabled successfully."
        }
        default
        {
            return "Unknown operation: " + $operationType + " for user: " + $user.username
        }
    }
}
# Check file path
if (!(Test-Path -Path $csvFilePath))
{
    Write-Host "File '$csvFilePath' was not found."
    return
}
# Import data
$csvFile = Import-Csv -Path $csvFilePath
foreach ($user in $csvFile)
{
    $result = ExecuteOperation $user.Name $user.Operation
    Write-Host $result
}

---

Hello Wayne,

Could you clarify the part about checking the Employee ID? According to your example, the CSV file contains only First Names, Last Names and Employee IDs of users. Do we understand correctly, that you need the script to find a user by Employee ID specified in the CSV file, check whether the First Name and Last Name match those in the CSV file for the user and disable the user if names match?

---

Hello,

Yes this is correct, check employee id and name matches from the CSV file to what is stored in AD then if they match disable the account.

Thank you

---

Hello Wayne,

To disable users by importing a CSV file, you will need to create a Scheduled Task configured for Domain-DNS object type that will execute the below script. No other configuration objects (Business Rules, Custom Commands, etc.) are required. For information on how to create Scheduled Tasks, have a look at the following tutorial: https://www.adaxes.com/tutorials_Automa ... gement.htm. On step 3 of the tutorial, select Domain-DNS Object type.

In the script:

• $csvFilePath - specifies the path to the CSV file;
• $employeeIDColumnName - specifies the name of the column containing Employee IDs of users;
• $firstNameColumnName - specifies the name of the column containing first names of users;
• $secondNameColumnName - specifies the name of the column containing surnames of users;
• $operationColumnName - specifies the name of the column containing the operation.

$csvFilePath = "\\Server\Share\example.csv" # TODO: modify me
$employeeIDColumnName = "EmployeeID" # TODO: modify me
$firstNameColumnName = "Name" # TODO: modify me
$secondNameColumnName = "Surname" # TODO: modify me
$operationColumnName = "Operation" # TODO: modify me

function SearchObjects($filter, $properties)
{
    $searcher = $Context.BindToObject("Adaxes://rootDSE")
    $searcher.SearchFilter = $filter
    $searcher.SearchScope = "ADS_SCOPE_SUBTREE"
    $searcher.PageSize = 500
    $searcher.ReferralChasing = "ADS_CHASE_REFERRALS_NEVER"
    $searcher.SetPropertiesToLoad($properties)
    $searcher.VirtualRoot = $True

    try
    {
        $searchResultIterator = $searcher.ExecuteSearch()
        $searchResults = $searchResultIterator.FetchAll()

        return ,$searchResults
    }
    finally
    {
        # Release resources
        if ($searchResultIterator){ $searchResultIterator.Dispose() }
    }
}

# Check file path
if (!(Test-Path -Path $csvFilePath))
{
    $Context.LogMessage("File '$csvFilePath' was not found.", "Warning")
    return
}

# Import data
$records = Import-Csv -Path $csvFilePath
$filter = New-Object "System.Text.StringBuilder"
foreach ($record in $records)
{
    if ($record.$operationColumnName -ne "Disable")
    {
        continue # Skip users with other operations
    }

    $employeeIDFilter = "(employeeID=" + $record.$employeeIDColumnName + ")"
    $firstNameFilter = "(givenName=" + $record.$firstNameColumnName + ")"
    $secondNameFilter = "(sn=" + $record.$secondNameColumnName + ")"
    [void]$filter.Append("(&$employeeIDFilter$firstNameFilter$secondNameFilter)")
}

if ($filter.Length -eq 0)
{
    return
}

# Search users
$searchResults = SearchObjects ("(&(sAMAccountType=805306368)(|$($filter.ToString())))") @($usernamePropertyName, "employeeID")
foreach ($searchResult in $searchResults)
{
    # Disable user account
    $user = $Context.BindToObject($searchResult.AdsPath)
    $user.AccountDisabled = $True
    $user.SetInfo()
}

---

Thank you so much for this. This will really help me push for a purchase order withint a week.

Really appreciate it, great support.

---

Hello Wayne,

Thank you for your good words, much appreciated!

Should you have any further requests, do not hesitate to contact our Support Team.