Hi
I have this script to disable users in AD and do a couple of other things along the way
the issue that I’m having here is that $Manager is not being reset to nothing.
as result when disabling 1 user I get the manager from the previous disabled user
when disabling multiple users the first accounts get the manager of the last disabled user
and the 2nd user to be disabled is getting the manager from the 1st user in the list.
what do I need to do to correct this?
#select CSV file that contains the people where the groups needs to be removed
#csv file needs to be a comma separated file
$users = import-csv c:\temp\toRemove.csv
$date= Get-Date -Format “yyyy-MM-dd”
$lastworkdate = (get-date).AddDays(-1).ToString(“yyyy-MM-dd”)
$DisabledOU = “OU=Disabled,OU=Regions,DC=test,DC=com”
foreach ($user in $users)
{
#get manager
$manager = (get-aduser (get-aduser $user.samAccountName -Properties manager).manager).Name
#get all the groups this user is member of an paste this in Note section
$groups =Get-ADPrincipalGroupMembership $user.SamAccountName
Set-ADUser $user.samAccountName -Replace @{info=$groups.name -join “rn”}
#remove department and Manager from user Add description and disable account
set-aduser $user.samAccountName -clear manager, department
set-aduser $user.SamAccountName -Description $description
get-ADUser $user.SamAccountName | Disable-ADAccount
$description = “Disabled by .adm on ” + $date +” Last workingday ” + $lastworkdate + ” Manager: “+ $manager
#add date to extension attribute nr15
Set-ADUser –Identity $user.SamAccountName -add @{“extensionattribute15″= $((Get-Date).ToShortDateString())}
$adgroups = Get-ADPrincipalGroupMembership -Identity $user.SamAccountName
foreach ($singlegroup in $adgroups)
{ # removing all groups except the domain user group pay attention a given group as also 1 samaccountname
if ($singlegroup.SamAccountName -notlike “*Domain Users*”)
# if ($singlegroup.SamAccountName -notlike “*Domain Users*” -and $singlegroup.SamAccountName -notlike “syncedToAzure”)
{
Remove-ADPrincipalGroupMembership -Identity $user.SamAccountName -MemberOf $singlegroup.SamAccountName -confirm:$false
}
}
#move user to disabled
get-aduser $user.SamAccountName | move-adobject -targetpath $DisabledOU
$manager = $null
$user = $null
}
