Hello,
Our script guy has finished his job. Find below a modified version of the script that does 3 things:
- Takes ownership of and deletes the user's Remote Desktop Services Profile folder.
- Takes ownership of and deletes the user's Home Folder.
- If the above two actions were successful (the script managed to delete the folders, or the specified folders were not set in the user's properties, or the specified folders were set in the user's properties, but were not found at the specified location), deletes the user account. If the script doesn't manage to delete one of the folders, it will exit with an error and will not delete the target user account.
# Get name of the user who invokes the script
$adminName = "$env:userdomain\$env:username"
# Function to get full access to all subdirectories in a directory
function GrantFullControlForDirectory($directoryPath, $username, $directoryWithFullPermission)
{
if($directoryWithFullPermission.Contains($directoryPath))
{
return
}
$directoryWithFullPermission.Add($directoryPath) | Out-Null
$directory = Get-Item -Path $directoryPath -Force
# Change directory owner
$ownerAcl = New-Object "System.Security.AccessControl.DirectorySecurity"
$ownerID = New-Object "System.Security.Principal.NTAccount" $username
$ownerAcl.SetOwner($ownerID)
$directory.SetAccessControl($ownerAcl)
# Set the Full Access permission
$directoryAcl = Get-Acl $directoryPath
$fullPermission = New-Object "System.Security.AccessControl.FileSystemAccessRule" $userName, "FullControl","ContainerInherit, ObjectInherit", "None", "Allow"
$directoryAcl.SetAccessRule($fullPermission)
Set-Acl -Path $directoryPath -AclObject $directoryAcl
$childItems = Get-ChildItem -Path $directoryPath -Force
if($childItems -eq $NULL)
{
return
}
foreach($item in $childItems)
{
if($item -is [System.IO.DirectoryInfo])
{
GrantFullControlForDirectory $item.FullName $username $directoryWithFullPermission
}
}
}
# Function to get full access to all files in a directory
function GrantFullControlForFiles($directoryPath, $username)
{
# Get full access to all files in the directory
$allFilePaths = [System.IO.Directory]::GetFiles($directoryPath,"*","AllDirectories")
foreach($filePath in $allFilePaths)
{
$file = Get-Item -Path $filePath -Force
# Change owner
$ownerAcl = New-Object "System.Security.AccessControl.FileSecurity"
$ownerID = New-Object "System.Security.Principal.NTAccount" $username
$ownerAcl.SetOwner($ownerID)
$file.SetAccessControl($ownerAcl)
# Set Full Access permission
$fileAcl = Get-Acl $filePath
$fullPermission = New-Object "System.Security.AccessControl.FileSystemAccessRule" $username, "FullControl", "Allow"
$fileAcl.SetAccessRule($fullPermission)
Set-Acl -Path $filePath -AclObject $fileAcl
}
}
$directoryWithFullPermission = New-Object "System.Collections.Generic.HashSet[System.String]"
# Get Remote Desktop Services profile path
$rdsProfilePath = $Context.TargetObject.TerminalServicesProfilePath
if($rdsProfilePath -ne $NULL)
{
# Remove the Remote Desktop Services profile folder
# Test the Remote Desktop Services profile path
if(!(Test-Path -Path $rdsProfilePath))
{
$Context.LogMessage("Remote Desktop Services profile path: $rdsProfilePath was not found", "Error") # TODO: modify me
}
else
{
GrantFullControlForDirectory $rdsProfilePath $adminName $directoryWithFullPermission
GrantFullControlForFiles $rdsProfilePath $adminName
try
{
Remove-Item -Path $rdsProfilePath -Force -Recurse -ErrorAction Stop
}
catch
{
$Context.LogMessage($_.Exception.Message, "Error") # TODO: modify me
return
}
}
}
else
{
$Context.LogMessage("No Remote Desktop Services profile path specified", "Information") # TODO: modify me
}
# Get Home Directory path
try
{
$homeDirectoryPath = $Context.TargetObject.Get("homeDirectory")
}
catch
{
$Context.LogMessage("Home directory path not specified.", "Error") # TODO: modify me
$homeDirectoryPath = $NULL
}
if($homeDirectoryPath -ne $NULL)
{
# Remove the home folder
# Test the home folder path
if(!(Test-Path -Path $homeDirectoryPath))
{
$Context.LogMessage("Home directory path: $homeDirectoryPath not found", "Error") # TODO: modify me
}
else
{
GrantFullControlForDirectory $homeDirectoryPath $adminName $directoryWithFullPermission
GrantFullControlForFiles $homeDirectoryPath $adminName
try
{
Remove-Item -Path $homeDirectoryPath -Force -Recurse -ErrorAction Stop
}
catch
{
$Context.LogMessage($_.Exception.Message, "Information") # TODO: modify me
return
}
}
}
# Delete the user
$Context.TargetObject.DeleteObject("ADM_DELETEOBJECTFLAGS_AUTO")