PowerShell: Disabling Lync Accounts

When you use certificate authentication with Lync, a user can still use Lync for up to 6 months by default. You can change this setting using the Set-CsWebServiceConfiguration -MaxValidityPeriodHours XX cmdlet. Even when we change this setting, once a user's AD account has been disabled we don't want them signing into Lync and using the system. In my environment when the user's account is disabled, the Lync account is disabled that night. Rather than adding to the Service Desk's task list, I automated the process.

This script searches AD for disabled accounts, checks to see if the account is still enabled for Lync and if so Lync disables it. It also removes the account from the AD Lync groups that we have. It then sends an email report of the accounts disabled and what the Conferencing Policy was.

Email report

** I'm posting the script here for you to review, but the display can mess with some of the HTML code I have included in the script. If you waould like to use it, I would recommend you download it from here.

#******************************************
#
#   DESCRIPTION:  Disables Lync accounts after the AD account has been disabled and removes from Lync AD groups
#   VERSION:  1.0
#   UPDATED: 
#   AUTHOR: Brad Roberts
#   CONTACT: brad@thatucguy.com
#   BLOG: http://www.thatUCguy.com
#   BLOG ENTRY:  http://www.thatucguy.com/2014/06/powershell-disabling-lync-accounts.html
#
#   DISCLAIMER: You running this script means you won't blame me if this breaks your stuff. This script is provided AS IS and is not guaranteed to work perfectly in your environment. Testing is always a good idea. Any risk in running this script is entirely on you.
#
#******************************************

#******************************************
#
# Variable Definitions
#
#******************************************

$strComputerName = gc env:computername
$strSMTPServer = "smtp.thatucguy.com"
$strToEmail = "lync.admin@thatucguy.com"
$strFromEmail = "no-reply@thatucguy.com"
$strSubject = "Lync User Disablement Report"
$dtTimeNow = get-date

#******************************************
#
# Load Required PS Modules
#
#******************************************

if ((Get-Module ActiveDirectory) -eq $null){Import-Module ActiveDirectory}
if ((Get-Module Lync) -eq $null){Import-Module Lync}

#******************************************
#
# Prepare HTML for email
#
#******************************************

$strScriptInfo = "


Script Info
Script Name:  " + $MyInvocation.MyCommand.Definition + "
Time:  " + $dtTimeNow + "
Run From:  " + $strComputerName

$strHTMLHeader = $strHTMLHeader + ""
$strHTMLHeader = $strHTMLHeader + ""
$strHTMLHeader = $strHTMLHeader + ""
$strHTMLHeader = $strHTMLHeader + ""
$strHTMLHeader = $strHTMLHeader + ""

$strHTMLFooter = $strHTMLFooter + $strScriptInfo
$strHTMLFooter = $strHTMLFooter + ""
$strHTMLFooter = $strHTMLFooter + ""

#********************************
#
# Look for AD accounts that are disabled but still enabled for Lync
# Remove from Lync AD groups
# Generate report of accounts to disable in Lync and disable them
#
#********************************

$strResults = $strResults + "
Lync User Disablement Report
"
$DisabledUsers = Get-CsAdUser | ?{$_.UserAccountControl -match "AccountDisabled" -and $_.Enabled -eq $true}
if ($DisabledUsers) {
 $DisabledUsers | Disable-CsUser
 Remove-ADGroupMember -Identity "Lync-2010-Users" -Members $DisabledUsers.samaccountname
 Remove-ADGroupMember -Identity "Lync-2010-Silver" -Members $DisabledUsers.samaccountname
 Remove-ADGroupMember -Identity "Lync-2010-Gold" -Members $DisabledUsers.samaccountname
 Remove-ADGroupMember -Identity "Lync-2010-Platinum" -Members $DisabledUsers.samaccountname
 $DisabledUsers = $DisabledUsers | Get-CsUser | Select-Object DisplayName,SamAccountName,SipAddress,ConferencingPolicy | ConvertTo-Html -fragment
 }
else {
 $DisabledUsers = "There is no one to disable."
 }
$strResults = $strResults + $DisabledUsers

#********************************
#
# Create email body
#
#********************************

$strHTMLBody = $strHTMLHeader + $strResults + $strHTMLFooter

#********************************
#
# Send email report
#
#********************************

$msg = new-object Net.Mail.MailMessage
$smtp = new-object Net.Mail.SmtpClient($strSMTPServer)

$msg.From = $strFromEmail
$strToEmail | foreach {$msg.To.Add($_)}
$msg.subject = $strSubject
$msg.IsBodyHtml = $true
$msg.body = $strHTMLBody
$smtp.Send($msg)

~ brad

"Good communication is as stimulating as black coffee, and just as hard to sleep after." ~ Anne Morrow Lindbergh

Managing Users with Default Policies

User Management is always fun. The longer you have Lync installed, the more policies seem to build up and overlap. Frequently I will pull and manage users based on the policies that they have assigned. This can be done through the Console, but it does get slow the more users you are trying to manage.

While I do have all of my Global policies configured, I prefer to keep specific policies assigned for the major policies. Like I mentioned above this can be slow and tricky in the Console. Finding users who already have a policy assigned is pretty easy using a command like:

Get-CsUser -filter {ConferencingPolicy -eq "Lync-Conferencing-Gold"}

This will pull up all the users with the specified policy name, and can easily be piped to another command such as Grant-CsMobilityPolicy.

Finding the users that are inheriting the default Global policy is a little trickier. Running the command

Get-CsUser -filter {ConferencingPolicy -eq "Default"}

will give you the following error.
   "Get-CsUser : Cannot bind parameter 'Filter' to the target. Exception setting "Filter": "Policy "Default" is not a user policy. You can assign only a user policy to a specific user."

In order to find all the users with the default policy assigned you will need to use a command like:

Get-CsUser -filter {ConferencingPolicy -eq $Null}

~brad

Fun Fact:
In a short period of ten years Van Gogh made approximately 900 paintings.

Changing a User's SIP Domain

One of the big projects that we have been working on is re-branding with a global image. This project started with migrating all of our users to have the same email domain and SIP domain. When Lync was initially installed the decision was made to support two SIP domains.

I was lucky and we only had a handful of users that needed to be changed to out primary SIP domain and could make the changes manually. To change a lot of users you could use a script like this. I have not tested this script, so test it first.

$UserList = Get-CsUser -Filter 'SipAddress -like "*olddomain.com"'
foreach ($User in $UserList)
{
   $oldAddress = $User.SipAddress
   $newAddress = $oldAddress -replace "@olddomain.com", "@newdomain.com"
   Set-CsUser -Identity $User.Identity -SipAddress $newAddress
}

Once you change all of the users, you will want to update the Lync and Exchange address books. The changes will update eventually depending on your replication time and when Address Books are scheduled to rebuild, but we want to have as little impact on the users as possible. I ran all of the PowerShell commands just to be on the safe side.

To update the Lync address book:
     Update-CsAddressBook

To update the Exchange address books:
     Update-GlobalAddressList
     Update-OfflineAddressBook

Impacts to the User

• When the change is made, the user will be logged off Lync, and they will need to log in with the new SIP address.
• Internal contacts should update the SIP address automatically – no action required.
• External contacts will have to re-add the user to their contact list.
• Lync Online Meetings will now be scheduled using the new meet web address. Any existing meetings will need to be rescheduled. There will be a delay between the changing of the SIP address and the ability to schedule meetings with the new address. Once you have updated the Exchange Address List and Offline Address Book the users will need to close and relaunch Outlook for this change to be picked up.

~ brad

Fun Fact:

The MS 150 is a two-day, 180-mile fund raising cycling ride organized by the National Multiple Sclerosis (MS) Society: Lone Star chapter. This ride is the largest event of its kind in North America taking in about 13,000 riders each year with a goal of raising $18 million towards finding a cure for MS.
This year's 30th Anniversary ride is scheduled 12-13 April 2014.