import list of users to disable

Question

Hello, We'd like to create a scheduled task that:

1. Imports a csv of users (there's a column with header sAMAccountName)
2. Disables the account
3. Changes the password to a random string ~12-20 characters long
4. Emails the user's manager + specific other addresses

What's the best way to do this, (or even start to do this so we can build on that knowledge for other tasks we'd like to schedule.)

Thanks!

Answer 1

Hello,

Have a look at the following tutorial: https://www.adaxes.com/tutorials_ActiveDirectoryManagement_ScheduleImportOfUsersFromCSV.htm.

Comments

Thanks for the link!

I see from the tutorial that I can include a column with header name 'Enabled' in the csv, and it looks like the second script in step 7 of the tutorial will do the trick.

Does it matter that the user accounts are spread across multiple OUs? The 'scheduled import wizard' looks like it affects only one OU - can you clarify that please?

Thanks

---

Hello,

Yes, that is correct. The script uses the distinguished name of the container that is specified in the Activity Scope of the Scheduled Task. If you need to update users in different locations, you will need to use a different approach. The following script from our repository should be helpful: https://www.adaxes.com/script-repository/import-new-and-updated-users-from-csv-file-s246.htm. If you have issues updating the script to meet your needs, we will gladly help you.

---

Aha! OK thanks - I've tweaked the variables a little in the first few lines so they are now:

<br>

Import-Module Adaxes

$csvFilePath = "\ourSERVER\ourshare\file.csv"
$userIdColumn = "userPrincipalName"
$userIdProperty = "sAMAccountName"
$accountPasswordColumn = "TempPasswd"
$aDObjectProperties = @("Manager")

$domainName = $Context.GetObjectDomain("%distinguishedName%")
$importedUsers  = Import-Csv -Path $csvFilePath

All the rest of the script is unchanged. Our csv headers are:: givenName,sn,name,mail,userPrincipalName,sAMAccountName,physicalDeliveryOfficeName,manager,employeeID,employeeType,extensionAttribute1,TempPasswd,Enabled

The manager column contains the name of the user's manager - as in the AD property name in the format "Alex Smith".

It looks like if we run this script it will create new users as well as disabling those with FALSE in the Enabled column of the csv. Two birds with one stone, yay!

1. Can you confirm that the variables as set in my above code will achieve our goal? 2. Will running this script create new users and that we can create a business rule to clean up the finer points of provisioning as described in https://www.adaxes.com/tutorials_AutomatingDailyTasks_AutomateUserProvisioning.htm ? 3. Is there a way to run this script in some kind of "verify" mode that outputs a report of changes that would have been made but does not actually make those changes?

If yes to all 3, and a 'how to' for Q3 then I think I will have all I need for the moment.

Graham

---

Hello,

Can you confirm that the variables as set in my above code will achieve our goal?

Yes, the variables look fine. However, the path in the $csvFilePath variable should start with a double slash:

$csvFilePath = "\\ourSERVER\ourshare\file.csv"

Will running this script create new users and that we can create a business rule to clean up the finer points of provisioning as described in https://www.adaxes.com/tutorials_AutomatingDailyTasks_AutomateUserProvisioning.htm ?

Yes.

Is there a way to run this script in some kind of "verify" mode that outputs a report of changes that would have been made but does not actually make those changes?

Yes, it is possible, however, you will need to significantly change the script for it to actually not perform any operations. Unfortunately, we do not have exact documentation for such an approach. If you have updating the script accordingly, we will gladly help you.