-
Notifications
You must be signed in to change notification settings - Fork 59
/
Invoke-ADCleanup.ps1
137 lines (110 loc) · 3.97 KB
/
Invoke-ADCleanup.ps1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
#AD Stale computer Object cleanup script
#Should be run as a scheduled task with a gMSA account that has permissions to read computer object attributes and modify/delete them.
#The computer it runs on must have RSAT installed for the ActiveDirectory module to be loaded.
#Suggestion is to run two instances of this script, one for servers and one for workstations
#Requires -Module ActiveDirectory
#Requires -RunAsAdministrator
#####Config
#Where to find computer objects (recursive)
$OUs = "OU=Windows 10,OU=Computers,DC=domain,DC=com"
#Inactivity threshhold
$DaysInactive = 60
#Where to moved inactive objects
$TargetOU = "OU=Inactive,OU=Computers,DC=domain,DC=com"
#Email SMTP variables
$SMTPUsername = "anonymous"
$SMTPPassword = ConvertTo-SecureString -String "anonymous" -AsPlainText -Force
$SMTPCredentials = New-Object System.Management.Automation.PSCredential($SMTPUsername,$SMTPPassword)
$SMTPServer = "smtp.domain.com”
$To = "[email protected]"
$bcc = "[email protected]"
$From = "Active Directory Monitor <[email protected]>"
$Subject = "Inactive Computers (Workstation) objects $(get-date -f ddMMyyyy)"
#####Execution
#Start logging...
$path = Get-Location
$scriptName = $MyInvocation.MyCommand.Name
$scriptLog = "$path\LOG_$scriptName.txt"
Start-Transcript -Path $scriptLog -Force -ErrorAction Stop
#What computers, OUs and the age of objects to find
$Time = (Get-Date).Adddays(-($DaysInactive))
$Today = Get-Date
$Description = "Account disabled due to inactivity on $Today"
$Computers = foreach ($OU in $OUs){Get-ADComputer -SearchBase $OU -SearchScope 'Subtree' -Filter {LastLogonTimeStamp -lt $Time} -Properties LastLogonTimeStamp | Select-Object Name,DistinguishedName}
# Creating initial email body area, including stylesheet
$Body = @"
<html>
<head>
<style type='text/css'>
h1 {
color: #f07f13;
font-family: verdana;
font-size: 20px;
}
h2 {
color: ##002933;
font-family: verdana;
font-size: 15px;
}
body {
color: #002933;
font-family: verdana;
font-size: 13px;
}
</style>
</head>
<body>
<h1>Inactive Computer Objects</h1>
<p>The following computers have been inactive for more than $DaysInactive days and is being disabled and moved to:</p>
<ul><li>{0}</li></ul>
<hr/>
<ul>
"@ -f $TargetOU
#Building body text for email contents
foreach ($Computer in $Computers) {
if ($Computer.DistinguishedName -notlike "*$TargetOU") {
Write-Verbose "Working on" $Computer.Name -Verbose
try {
Set-ADComputer -Identity $Computer.Name -Enabled $false -Description $Description
Move-ADObject -Identity $Computer.DistinguishedName -TargetPath $TargetOU
Write-Verbose "Succesfully moved and disabled $($Computer.Name)" -Verbose
$Body += "<li>$($Computer.Name)</li>"
}
catch {
Write-Error "$($Computer.Name) could not be moved"
$Body += "<li><font color=red>$($Computer.Name) - COULD NOT BE MOVED!</font></li>"
continue
}
} else {
Write-Host -ForegroundColor Cyan "$($Computer.Name) has already been moved - doing nothing"
}
}
#Change email body if there where inactive computers or not
if ($Computers -eq $null){
$Body += @"
<h2><font color=green>No inactive computers this week - how great is that? :)</font></h2>
</body>
</html>
"@
Write-Verbose "No inactive computers" -Verbose
} else {
$Body += @"
</ul>
<hr/>
</body>
</html>
"@
}
#Sending email message
try {
Write-Verbose "Sending email to $To and $bcc..." -Verbose
Send-MailMessage -To $To -From $From -Bcc $bcc -Subject $Subject -Body $Body -smtpServer $SMTPServer -BodyAsHtml -Credential $SMTPCredentials -ErrorAction Stop
} catch {
$Error
Throw "Could not send email!"
Stop-Transcript
exit 1
}
Write-Verbose "Finished..." -Verbose
#Stop logging
Stop-Transcript