forked from AndrewEllis93/PowerShell-Scripts
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Move-Disabled.ps1
508 lines (453 loc) · 25 KB
/
Move-Disabled.ps1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
####################################################
#
# Title: Move-Disabled
# Date Created : 2017-12-28
# Last Edit: 2018-02-22
# Author : Andrew Ellis
# GitHub: https://github.com/AndrewEllis93/PowerShell-Scripts
#
# This moves disabled computers too. It rounds up disabled accounts and ages them through different OUs (0-30 days, 30-180 days, over 180 days).
#
# WARNING: THIS SCRIPT WILL OVERWRITE EXTENSIONATTRIBUTE3, MAKE SURE YOU ARE NOT USING IT FOR ANYTHING ELSE
#
# This script will not create the OUs for you.
# CREATE AN OU STRUCTURE UNDER YOUR PARENT OU AS FOLLOWS:
#
# Parent OU (specified by user)
# -> Users
# --> 0-30 Days
# --> 30-180 Days
# --> Over 180 Days
#
# -> Computers
# --> 0-30 Days
# --> 30-180 Days
# --> Over 180 Days
#
####################################################
Function Move-Disabled {
<#
.SYNOPSIS
This moves disabled users and computers. It rounds up disabled accounts and ages them through different OUs (0-30 days, 30-180 days, over 180 days).
.DESCRIPTION
WARNING: THIS SCRIPT WILL OVERWRITE EXTENSIONATTRIBUTE3, MAKE SURE YOU ARE NOT USING IT FOR ANYTHING ELSE
ExtensionAttribute3 is used to stamp the disablement date. This function will also clear ExtensionAttribute3 for any objects that are not disabled / not in the specified OU.
"ReportOnly" will not take any actions, only output the WhatIfs to the console/log. RUN THIS FIRST to get an idea of what it will do.
The InactivityDays argument is optional, but is there for if you are using my Disable-InactiveADAccounts script. This is so it can account for inactivity in its calculations. Please make sure you use the same on both.
.EXAMPLE
Move-Disabled -ParentOU "OU=Disabled Objects,DC=domain,DC=local" -InactivityDays 30 -ComputerInactivityDays 60 -ExclusionUserGroups @('ServiceAccts') -ExclusionOUs @('OU=Test,DC=domain,DC=local','OU=Test2,DC=domain,DC=local') -DeleteComputersAt180 -DeleteUsersAt180 -ReportOnly
.LINK
https://github.com/AndrewEllis93/PowerShell-Scripts
.NOTES
Author: Andrew Ellis
#>
Param (
[Parameter(Mandatory=$true)][string]$ParentOU,
[array]$ExclusionUserGroups,
[switch]$ReportOnly = $False,
[int]$UserInactivityDays = 30,
[int]$ComputerInactivityDays = 30,
[array]$ExclusionOUs,
[switch]$DeleteComputersAt180= $False,
[switch]$DeleteUsersAt180= $False
)
#DECLARATIONS
#Declares misc variables.
$MovedUsers = 0 #Leave at 0.
$MovedComputers = 0 #Leave at 0.
#MOVE NEWLY DISABLED USERS
Write-Host ""
Write-Output "NEWLY DISABLED MOVE:"
#Gets all newly users. msExchRecipientTypeDetails makes sure we are excluding things like shared mailboxes.
Write-Output "Getting newly disabled users..."
$DisabledUsers =
Search-ADAccount -AccountDisabled -UsersOnly |
Get-ADUser -Properties msExchRecipientTypeDetails,info,Enabled,distinguishedName,ExtensionAttribute3 |
Where-Object {
@(1,128,65536,2097152,2147483648,$null) -contains $_.msExchRecipientTypeDetails -and
$_.DistinguishedName -notlike "*Builtin*" -and
$_.DistinguishedName -notlike "*$ParentOU" -and
$Exclusions.SamAccountName -notcontains $_.SamAccountName
}
#AD group filters if specified.
If ($ExclusionUserGroups){
[array]$FilterUserSAMs = @()
ForEach ($ExclusionUserGroup in $ExclusionUserGroups){
Write-Output "Getting $ExclusionUserGroup members..."
$FilterUserSAMs += (Get-ADGroupMember $ExclusionUserGroup -ErrorAction Stop).SamAccountName
}
$DisabledUsers = $DisabledUsers | Where-Object {$FilterUserSAMs -notcontains $_.SamAccountName}
}
#OU filters if specified.
If ($ExclusionOUs){
[array]$FilterArray = @()
ForEach ($ExclusionOU in $ExclusionOUs){
$FilterArray += "`$_.DistinguishedName -NotLike `"*$ExclusionOU`""
}
$Filter = [scriptblock]::Create($FilterArray -join " -and ")
$DisabledUsers = $DisabledUsers | Where-Object -FilterScript $Filter
}
Write-Output ($DisabledUsers.Count.toString() + " newly disabled user objects were found.")
#Loops through the newly disabled users found.
ForEach ($DisabledUser in $DisabledUsers){
#Moves the user.
Write-Output ("Moving user: " + $DisabledUser.SamAccountName + "...")
If ($ReportOnly) {
Move-ADObject -Identity $DisabledUser.DistinguishedName -TargetPath "OU=0-30 Days,OU=Users,$ParentOU" -WhatIf
}
Else {
Move-ADObject -Identity $DisabledUser.DistinguishedName -TargetPath "OU=0-30 Days,OU=Users,$ParentOU"
}
$MovedUsers++
#Sets the info (notes) field with the old OU.
#Formats the new info field (notes). Retains old info if any exists.
Write-Output ("Setting info field for user: " + $DisabledUser.SamAccountName + "...")
#Gets the parent OU.
$OU = $DisabledUser.DistinguishedName.Split(',',2)[1]
If ([string]::IsNullOrWhiteSpace($DisabledUser.Info)){
$NewInfo = "OLD OU: " + $OU
}
Else {
$NewInfo = "OLD OU: " + $OU + "`n" + $DisabledUser.Info
}
If ($ReportOnly){
Set-ADUser -Identity $DisabledUser.SamAccountName -Replace @{info=$NewInfo} -WhatIf
}
Else {
Set-ADUser -Identity $DisabledUser.SamAccountName -Replace @{info=$NewInfo}
}
#Sets ExtensionAttribute3 for the date of disablement.
If ($DisabledUser.ExtensionAttribute3 -notlike "INACTIVE*"){
$Date = "DISABLED ON " + (Get-Date)
Write-Output ("Setting ExtensionAttribute3 for user: " + $DisabledUser.SamAccountName + "...")
If ($ReportOnly) {
Set-ADUser -Identity $DisabledUser.SamAccountName -Replace @{ExtensionAttribute3=$Date} -WhatIf
}
Else {
Set-ADUser -Identity $DisabledUser.SamAccountName -Replace @{ExtensionAttribute3=$Date}
}
}
}
#MOVE NEWLY DISABLED COMPUTERS
#Get disabled computer accounts.
Write-Output "Getting disabled computers..."
$DisabledComputers = Get-ADComputer -Filter * -Properties Enabled,Description,distinguishedName,ExtensionAttribute3 | Where-Object {
$_.Enabled -eq $False -and
$_.DistinguishedName -notlike "*$ParentOU"
}
Write-Output ($DisabledComputers.Count.toString() + " newly disabled computer objects were found.")
ForEach ($DisabledComputer in $DisabledComputers){
#Moves the Computer.
Write-Output ("Moving computer: " + $DisabledComputer.SamAccountName + "...")
If ($ReportOnly) {
Move-ADObject -Identity $DisabledComputer.DistinguishedName -TargetPath "OU=0-30 Days,OU=Computers,$ParentOU" -WhatIf
}
Else {
Move-ADObject -Identity $DisabledComputer.DistinguishedName -TargetPath "OU=0-30 Days,OU=Computers,$ParentOU"
}
$MovedComputers++
#Sets the description (notes) field with the old OU.
#Formats the new description field (notes). Retains old Description if any exists.
Write-Output ("Setting Description field for computer: " + $DisabledComputer.SamAccountName + "...")
#Gets the parent OU.
$OU = $DisabledComputer.DistinguishedName.Split(',',2)[1]
If ([string]::IsNullOrWhiteSpace($DisabledComputer.Description)){
$NewDescription = "OLD OU: " + $OU
}
Else{
$NewDescription = "OLD OU: " + $OU + " | " + $DisabledComputer.Description
}
If ($ReportOnly){
Set-ADComputer -Identity $DisabledComputer.SamAccountName -Replace @{Description=$NewDescription} -WhatIf
}
Else {
Set-ADComputer -Identity $DisabledComputer.SamAccountName -Replace @{Description=$NewDescription}
}
#Sets ExtensionAttribute3 for the date of disablement.
If ($DisabledComputer.ExtensionAttribute3 -notlike "INACTIVE*"){
$Date = "DISABLED ON " + (Get-Date)
Write-Output ("Setting ExtensionAttribute3 for computer: " + $DisabledComputer.SamAccountName + "...")
If ($ReportOnly) {
Set-ADComputer -Identity $DisabledComputer.SamAccountName -Replace @{ExtensionAttribute3=$Date} -WhatIf
}
Else {
Set-ADComputer -Identity $DisabledComputer.SamAccountName -Replace @{ExtensionAttribute3=$Date}
}
}
}
#INCREMENT THROUGH OUS BASED ON AGE
Write-Host ""
Write-Output "OU INCREMENTATION:"
#Gets objects in the disabled OU
$DisabledOUUsers = Get-ADUser -Filter * -SearchBase $ParentOU -Properties ExtensionAttribute3,DistinguishedName,SamAccountName,Enabled | Where-Object {!$_.Enabled}
$DisabledOUComputers = Get-ADComputer -Filter * -SearchBase $ParentOU -Properties ExtensionAttribute3,DistinguishedName,SamAccountName,Enabled | Where-Object {!$_.Enabled}
#USERS
#Declares counts for output.
$30to180DayMovedUsers = 0
$180DayMovedUsers = 0
$180DayDeletedUsers = 0
#Loops through users and checks if older than 30 days.
ForEach ($DisabledOUUser in $DisabledOUUsers){
#Sets the date disabled if not already set
If ([string]::IsNullOrWhiteSpace($DisabledOUUser.ExtensionAttribute3) -or $DisabledOUUser.ExtensionAttribute3 -like "RE-ENABLED*"){
Write-Output ("Setting ExtensionAttribute 3 for user: " + $DisabledOUUser.SamAccountName + " (user was in disabled objects OU but did not have a disabled date.)")
$Date = "DISABLED ON " + (Get-Date)
If ($ReportOnly){
Set-ADUser -Identity $DisabledOUUser.SamAccountName -Replace @{ExtensionAttribute3=$Date} -WhatIf
}
Else {
Set-ADUser -Identity $DisabledOUUser.SamAccountName -Replace @{ExtensionAttribute3=$Date}
}
#Sets the variable for comparison in the rest of the loop. It was null.
$DisabledOUUser.ExtensionAttribute3 = $Date
}
#Extracts the date disabled for comparison.
#If disabled by hand, count from the disable date
If ($DisabledOUUser.ExtensionAttribute3 -like "DISABLED ON*"){
$DateDisabled = [datetime]($DisabledOUUser.ExtensionAttribute3.Replace('DISABLED ON ',''))
$DaysDisabled = (New-TimeSpan -Start $DateDisabled -End (Get-Date)).Days
}
#If auto-disabled because of inactivity (Disable-InactiveADAccounts script), add extra days to account for that.
ElseIf ($DisabledOUUser.ExtensionAttribute3 -like "INACTIVE SINCE*"){
$DateDisabled = [datetime]($DisabledOUUser.ExtensionAttribute3.Replace('INACTIVE SINCE ',''))
$DaysDisabled = (New-TimeSpan -Start $DateDisabled.AddDays($UserInactivityDays) -End (Get-Date)).Days
}
Else {Write-Error ($DisabledOUUser.SamAccountName + " has an invalid disable date in ExtensionAttribute3.")}
#Increment through OUs
If ($DaysDisabled -ge 30 -and $DaysDisabled -le 180 -and $DisabledOUUser.DistinguishedName -notlike "*OU=30-180 Days,OU=Users,$ParentOU"){
Write-Output ("Moving user to the 30-180 Days OU: " + $DisabledOUUser.SamAccountName)
If ($ReportOnly) {
Move-ADObject -Identity $DisabledOUUser.DistinguishedName -TargetPath "OU=30-180 Days,OU=Users,$ParentOU" -WhatIf
}
Else {
Move-ADObject -Identity $DisabledOUUser.DistinguishedName -TargetPath "OU=30-180 Days,OU=Users,$ParentOU"
}
$30to180DayMovedUsers++
}
Else {
If (!$DeleteUsersAt180){
If ($DaysDisabled -gt 180 -and $DisabledOUUser.DistinguishedName -notlike "*OU=Over 180 Days,OU=Users,$ParentOU"){
Write-Output ("Moving user to the Over 180 Days OU: " + $DisabledOUUser.SamAccountName)
If ($ReportOnly) {
Move-ADObject -Identity $DisabledOUUser.DistinguishedName -TargetPath "OU=Over 180 Days,OU=Users,$ParentOU" -WhatIf
}
Else {
Move-ADObject -Identity $DisabledOUUser.DistinguishedName -TargetPath "OU=Over 180 Days,OU=Users,$ParentOU"
}
$180DayMovedUsers++
}
}
Else {
If ($DaysDisabled -gt 180){
Write-Output ("Deleting >180 day inactive user: " + $DisabledOUUser.SamAccountName)
If ($ReportOnly) {
Remove-ADObject $DisabledOUUser.DistinguishedName -WhatIf
}
Else {
Remove-ADObject $DisabledOUUser.DistinguishedName -Recursive -Confirm:$False
}
$180DayDeletedUsers++
}
}
}
}
#COMPUTERS
#Declares counts for output.
$30to180DayMovedComputers = 0
$180DayMovedComputers = 0
$180DayDeletedComputers = 0
#Loops through computers and checks if older than 90 days.
ForEach ($DisabledOUComputer in $DisabledOUComputers){
#Sets the date disabled if not already set
If ([string]::IsNullOrWhiteSpace($DisabledOUComputer.ExtensionAttribute3) -or $DisabledOUComputer.ExtensionAttribute3 -like "RE-ENABLED*"){
Write-Output ("Setting ExtensionAttribute 3 for Computer: " + $DisabledOUComputer.SamAccountName + " (computer was in disabled objects OU but did not have a disabled date.)")
$Date = "DISABLED ON " + (Get-Date)
If ($ReportOnly){
Set-ADComputer -Identity $DisabledOUComputer.SamAccountName -Replace @{ExtensionAttribute3=$Date} -WhatIf
}
Else {
Set-ADComputer -Identity $DisabledOUComputer.SamAccountName -Replace @{ExtensionAttribute3=$Date}
}
#Sets the variable for comparison in the rest of the loop. It was null.
$DisabledOUComputer.ExtensionAttribute3 = $Date
}
#Extracts the date disabled for comparison.
#If disabled by hand, count from the disable date
If ($DisabledOUComputer.ExtensionAttribute3 -like "DISABLED ON*"){
$DateDisabled = [datetime]($DisabledOUComputer.ExtensionAttribute3.Replace('DISABLED ON ',''))
$DaysDisabled = (New-TimeSpan -Start $DateDisabled -End (Get-Date)).Days
}
#If auto-disabled because of inactivity (Disable-InactiveADAccounts script), add extra days to account for that.
ElseIf ($DisabledOUComputer.ExtensionAttribute3 -like "INACTIVE SINCE*"){
$DateDisabled = [datetime]($DisabledOUComputer.ExtensionAttribute3.Replace('INACTIVE SINCE ',''))
$DaysDisabled = (New-TimeSpan -Start $DateDisabled.AddDays($ComputerInactivityDays) -End (Get-Date)).Days
}
Else {Write-Error ($DisabledOUComputer.SamAccountName + " has an invalid disable date in ExtensionAttribute3.")}
#Increment through OUs
If ($DaysDisabled -ge 30 -and $DaysDisabled -le 180 -and $DisabledOUComputer.DistinguishedName -notlike "*OU=30-180 Days,OU=Computers,$ParentOU"){
Write-Output ("Moving computer to the 30-180 Days OU: " + $DisabledOUComputer.SamAccountName)
If ($ReportOnly) {
Move-ADObject -Identity $DisabledOUComputer.DistinguishedName -TargetPath "OU=30-180 Days,OU=Computers,$ParentOU" -WhatIf
}
Else {
Move-ADObject -Identity $DisabledOUComputer.DistinguishedName -TargetPath "OU=30-180 Days,OU=Computers,$ParentOU"
}
$30to180DayMovedComputers++
}
Else{
If (!$DeleteComputersAt180){
If ($DaysDisabled -gt 180 -and $DisabledOUComputer.DistinguishedName -notlike "*OU=Over 180 Days,OU=Computers,$ParentOU"){
Write-Output ("Moving computer to the Over 180 Days OU: " + $DisabledOUComputer.SamAccountName)
If ($ReportOnly) {
Move-ADObject -Identity $DisabledOUComputer.DistinguishedName -TargetPath "OU=Over 180 Days,OU=Computers,$ParentOU" -WhatIf
}
Else {
Move-ADObject -Identity $DisabledOUComputer.DistinguishedName -TargetPath "OU=Over 180 Days,OU=Computers,$ParentOU"
}
$180DayMovedComputers++
}
}
Else {
If ($DaysDisabled -gt 180){
Write-Output ("Deleting >180 day inactive computer: " + $DisabledOUcomputer.SamAccountName)
If ($ReportOnly) {
Remove-ADObject $DisabledOUcomputer.DistinguishedName -WhatIf
}
Else {
Remove-ADObject $DisabledOUcomputer.DistinguishedName -Recursive -Confirm:$False
}
$180DayDeletedcomputers++
}
}
}
}
#SUMMARY OUTPUT
#Writes the counts of what was modified etc.
Write-Output 'TOTALS:'
$MovedUsers = $MovedUsers.tostring()
Write-Output ($MovedUsers + ' user(s) moved to the "0-30 Days" OU.')
$MovedComputers = $MovedComputers.tostring()
Write-Output ($MovedComputers + ' computer(s) moved to the "0-30 Days" OU.')
Write-Output ''
$30to180DayMovedUsers = $30to180DayMovedUsers.tostring()
Write-Output ($30to180DayMovedUsers + ' user(s) moved to the "30-180 Days" OU.')
$30to180DayMovedComputers = $30to180DayMovedComputers.tostring()
Write-Output ($30to180DayMovedComputers + ' computer(s) moved to the "30-180 Days" OU.')
Write-Output ''
If (!$DeleteUsersAt180){
$180DayMovedUsers = $180DayMovedUsers.tostring()
Write-Output ($180DayMovedUsers + ' user(s) moved to the "Over 180 Days" OU.')
}
Else {
$180DayDeletedUsers = $180DayDeletedUsers.tostring()
Write-Output ($180DayDeletedUsers + ' user(s) were DELETED for >180 days of inactivity.')
}
If (!$DeleteComputersAt180){
$180DayMovedComputers = $180DayMovedComputers.tostring()
Write-Output ($180DayMovedComputers + ' computer(s) moved to the "Over 180 Days" OU.')
}
Else {
$180DayDeletedComputers = $180DayDeletedComputers.tostring()
Write-Output ($180DayDeletedComputers + ' computer(s) were DELETED for >180 days of inactivity.')
}
Write-Output ''
#ATTRIBUTE CLEANUP
#Gets all AD objects with ExtensionAttribute3 incorrectly set, and clears it."
Write-Output ""
Write-Output "ATTRIBUTE CLEANUP:"
Write-Output "Finding enabled users with incorrect ExtensionAttribute3 attributes..."
$MalformedUsers = Get-ADUser -Filter * -Properties DistinguishedName,ExtensionAttribute3,SamAccountName,Enabled | Where-Object {
$_.DistinguishedName -NotLike "*$ParentOU" -and
$_.Enabled -eq $True -and
![string]::IsNullOrEmpty($_.ExtensionAttribute3) -and
$_.ExtensionAttribute3 -notlike "DISABLED ON*" -and
$_.ExtensionAttribute3 -notlike "INACTIVE SINCE*" -and
$_.ExtensionAttribute3 -notlike "RE-ENABLED ON*"
}
$MalformedComputers = Get-ADComputer -Filter * -Properties DistinguishedName,ExtensionAttribute3,SamAccountName,Enabled | Where-Object {
$_.DistinguishedName -NotLike "*$ParentOU" -and
$_.Enabled -eq $True -and
![string]::IsNullOrEmpty($_.ExtensionAttribute3) -and
$_.ExtensionAttribute3 -notlike "DISABLED ON*" -and
$_.ExtensionAttribute3 -notlike "INACTIVE SINCE*" -and
$_.ExtensionAttribute3 -notlike "RE-ENABLED ON*"
}
Write-Output (($MalformedUsers.SamAccountName.Count).ToString() + " users were found.")
Write-Output (($MalformedComputers.SamAccountName.Count).ToString() + " computers were found.")
ForEach ($MalformedUser in $MalformedUsers){
Write-Output ("Clearing ExtensionAttribute3 for " + $MalformedUser.SamAccountName + "...")
If ($ReportOnly){
Set-ADUser -Identity $MalformedUser.SamAccountName -Clear ExtensionAttribute3 -WhatIf
}
Else {
Set-ADUser -Identity $MalformedUser.SamAccountName -Clear ExtensionAttribute3
}
}
ForEach ($MalformedComputer in $MalformedComputers){
Write-Output ("Clearing ExtensionAttribute3 for " + $MalformedComputer.SamAccountName + "...")
If ($ReportOnly){
Set-ADComputer -Identity $MalformedComputer.SamAccountName -Clear ExtensionAttribute3 -WhatIf
}
Else {
Set-ADComputer -Identity $MalformedComputer.SamAccountName -Clear ExtensionAttribute3
}
}
}
#LOGGING FUNCTION - starts transcript and cleans logs older than specified retention date.
Function Start-Logging {
<#
.SYNOPSIS
This function starts a transcript in the specified directory and cleans up any files older than the specified number of days.
.DESCRIPTION
Please ensure that the log directory specified is empty, as this function will clean that folder.
.EXAMPLE
Start-Logging -LogDirectory "C:\ScriptLogs\LogFolder" -LogName $LogName -LogRetentionDays 30
.LINK
https://github.com/AndrewEllis93/PowerShell-Scripts
.NOTES
Author: Andrew Ellis
#>
Param (
[Parameter(Mandatory=$true)]
[String]$LogDirectory,
[Parameter(Mandatory=$true)]
[String]$LogName,
[Parameter(Mandatory=$true)]
[Int]$LogRetentionDays
)
#Sets screen buffer from 120 width to 500 width. This stops truncation in the log.
$ErrorActionPreference = 'SilentlyContinue'
$pshost = Get-Host
$pswindow = $pshost.UI.RawUI
$newsize = $pswindow.BufferSize
$newsize.Height = 3000
$newsize.Width = 500
$pswindow.BufferSize = $newsize
$newsize = $pswindow.WindowSize
$newsize.Height = 50
$newsize.Width = 500
$pswindow.WindowSize = $newsize
$ErrorActionPreference = 'Continue'
#Remove the trailing slash if present.
If ($LogDirectory -like "*\") {
$LogDirectory = $LogDirectory.SubString(0,($LogDirectory.Length-1))
}
#Create log directory if it does not exist already
If (!(Test-Path $LogDirectory)) {
New-Item -ItemType Directory $LogDirectory -Force | Out-Null
}
$Today = Get-Date -Format M-d-y
Start-Transcript -Append -Path ($LogDirectory + "\" + $LogName + "." + $Today + ".log") | Out-Null
#Shows proper date in log.
Write-Output ("Start time: " + (Get-Date))
#Purges log files older than X days
$RetentionDate = (Get-Date).AddDays(-$LogRetentionDays)
Get-ChildItem -Path $LogDirectory -Recurse -Force | Where-Object { !$_.PSIsContainer -and $_.CreationTime -lt $RetentionDate -and $_.Name -like "*.log"} | Remove-Item -Force
}
#Start logging
Start-Logging -LogDirectory "C:\ScriptLogs\Move-DisabledLog" -LogName "Move-DisabledLog" -LogRetentionDays 30
#Call function
Move-Disabled -ParentOU "OU=Disabled Objects,DC=domain,DC=local" -UserInactivityDays 30 -ComputerInactivityDays 60 -ReportOnly -ExclusionOUs @('OU=Test,DC=domain,DC=local','OU=Test2,DC=domain,DC=local') -ExclusionUserGroups @('ServiceAccts')
#Stop logging.
Write-Output ("Stop time: " + (Get-Date))
Stop-Transcript