PowerShell: Disabling Lync Accounts

When you use certificate authentication with Lync, a user can still use Lync for up to 6 months by default. You can change this setting using the Set-CsWebServiceConfiguration -MaxValidityPeriodHours XX cmdlet. Even when we change this setting, once a user's AD account has been disabled we don't want them signing into Lync and using the system. In my environment when the user's account is disabled, the Lync account is disabled that night. Rather than adding to the Service Desk's task list, I automated the process.

This script searches AD for disabled accounts, checks to see if the account is still enabled for Lync and if so Lync disables it. It also removes the account from the AD Lync groups that we have. It then sends an email report of the accounts disabled and what the Conferencing Policy was.

Email report

** I'm posting the script here for you to review, but the display can mess with some of the HTML code I have included in the script. If you waould like to use it, I would recommend you download it from here.

#******************************************
#
#   DESCRIPTION:  Disables Lync accounts after the AD account has been disabled and removes from Lync AD groups
#   VERSION:  1.0
#   UPDATED: 
#   AUTHOR: Brad Roberts
#   CONTACT: brad@thatucguy.com
#   BLOG: http://www.thatUCguy.com
#   BLOG ENTRY:  http://www.thatucguy.com/2014/06/powershell-disabling-lync-accounts.html
#
#   DISCLAIMER: You running this script means you won't blame me if this breaks your stuff. This script is provided AS IS and is not guaranteed to work perfectly in your environment. Testing is always a good idea. Any risk in running this script is entirely on you.
#
#******************************************

#******************************************
#
# Variable Definitions
#
#******************************************

$strComputerName = gc env:computername
$strSMTPServer = "smtp.thatucguy.com"
$strToEmail = "lync.admin@thatucguy.com"
$strFromEmail = "no-reply@thatucguy.com"
$strSubject = "Lync User Disablement Report"
$dtTimeNow = get-date

#******************************************
#
# Load Required PS Modules
#
#******************************************

if ((Get-Module ActiveDirectory) -eq $null){Import-Module ActiveDirectory}
if ((Get-Module Lync) -eq $null){Import-Module Lync}

#******************************************
#
# Prepare HTML for email
#
#******************************************

$strScriptInfo = "


Script Info
Script Name:  " + $MyInvocation.MyCommand.Definition + "
Time:  " + $dtTimeNow + "
Run From:  " + $strComputerName

$strHTMLHeader = $strHTMLHeader + ""
$strHTMLHeader = $strHTMLHeader + ""
$strHTMLHeader = $strHTMLHeader + ""
$strHTMLHeader = $strHTMLHeader + ""
$strHTMLHeader = $strHTMLHeader + ""

$strHTMLFooter = $strHTMLFooter + $strScriptInfo
$strHTMLFooter = $strHTMLFooter + ""
$strHTMLFooter = $strHTMLFooter + ""

#********************************
#
# Look for AD accounts that are disabled but still enabled for Lync
# Remove from Lync AD groups
# Generate report of accounts to disable in Lync and disable them
#
#********************************

$strResults = $strResults + "
Lync User Disablement Report
"
$DisabledUsers = Get-CsAdUser | ?{$_.UserAccountControl -match "AccountDisabled" -and $_.Enabled -eq $true}
if ($DisabledUsers) {
 $DisabledUsers | Disable-CsUser
 Remove-ADGroupMember -Identity "Lync-2010-Users" -Members $DisabledUsers.samaccountname
 Remove-ADGroupMember -Identity "Lync-2010-Silver" -Members $DisabledUsers.samaccountname
 Remove-ADGroupMember -Identity "Lync-2010-Gold" -Members $DisabledUsers.samaccountname
 Remove-ADGroupMember -Identity "Lync-2010-Platinum" -Members $DisabledUsers.samaccountname
 $DisabledUsers = $DisabledUsers | Get-CsUser | Select-Object DisplayName,SamAccountName,SipAddress,ConferencingPolicy | ConvertTo-Html -fragment
 }
else {
 $DisabledUsers = "There is no one to disable."
 }
$strResults = $strResults + $DisabledUsers

#********************************
#
# Create email body
#
#********************************

$strHTMLBody = $strHTMLHeader + $strResults + $strHTMLFooter

#********************************
#
# Send email report
#
#********************************

$msg = new-object Net.Mail.MailMessage
$smtp = new-object Net.Mail.SmtpClient($strSMTPServer)

$msg.From = $strFromEmail
$strToEmail | foreach {$msg.To.Add($_)}
$msg.subject = $strSubject
$msg.IsBodyHtml = $true
$msg.body = $strHTMLBody
$smtp.Send($msg)

~ brad

"Good communication is as stimulating as black coffee, and just as hard to sleep after." ~ Anne Morrow Lindbergh