SCORCH : Active Directory Cleanup with Orchestrator

Active Directory Cleanup Runbook Automation

6 runbooks – 5 are functional workbooks and 1^st runbook calls the rest in sequence.

Download the Powershell Scripts – ad cleanup runbook ps

Runbook 1 – AD Cleanup

The Master Runbook – which triggers every 7 days 16 hours – call the 5 runbooks and they a ‘wait for completion’ before starting the next runbook.

Runbook 2 – Scan and Dump List

Powershell script which scans Active Directory [admin rights not required], check machines which are inactive for 180 days and machine should not be disabled – Operating System = WinXP, Win7 or Win10.

C:\windows\System32\WindowsPowerShell\v1.0\powershell.exe {import-module activedirectory

$DaysInactive = 180

$time = (Get-Date).Adddays(-($DaysInactive))

$result=@()

$result2=@()

#————————————————————————————————————————–

Get-ADComputer -Filter {(Modified -lt $time) -and (useraccountcontrol -ne “4098”)} -Properties * |

select Name,OperatingSystem | foreach {if (($_.OperatingSystem -like “Windows 7*”) -or($_.OperatingSystem -like “Windows 10*”) -or ($_.OperatingSystem -like “Windows 8*”) -or ($_.OperatingSystem -like “Windows xp*”)) {$result+=$_.Name}}

$result | set-content C:\SourceSoftware\runbook-output\adcleaner\output\ad-cleaner.csv}

Runbook 3 – Scan and Disable Scheduled Task

Powershell script to Disable machines in AD [requires Admin rights] found in earlier Runbook

#Setting search parameters and creating array

import-module activedirectory

$DaysInactive = 180

$time = (Get-Date).Adddays(-($DaysInactive))

$result=@()

#————————————————————————————————————————–

#Searching for computers that fit the parameters

Get-ADComputer -Filter {(LastLogonDate -lt $time) -and (Enabled -eq “True”)} -Properties * -ErrorAction SilentlyContinue |

select Name,OperatingSystem,comment,CN,LastLogonDate,DistinguishedName | foreach {if (($_.OperatingSystem -like “Windows 7*”) -or($_.OperatingSystem -like “Windows 10*”) -or ($_.OperatingSystem -like “Windows 8*”) -or ($_.OperatingSystem -like “Windows xp*”)) {$result+=$_}}

#Disabling computers

#$result|Foreach-Object {Disable-ADAccount -Identity $_.DistinguishedName -recursive -ErrorAction SilentlyContinue}

foreach ($_ in $result)

{If ($_ -ne $Null)

{Disable-AdAccount -Identity $_.DistinguishedName}}

#————————————————————————————————-

Runbook 4 – Scan Disabled and Delete Scheduled Task + Log

Powershell Script to scan for machines inactive for 360 days and disabled, then delete them [required AD Admin rights]

#Setting search parameters and creating array

import-module activedirectory

$DaysInactive = 360

$time = (Get-Date).Adddays(-($DaysInactive))

$result=@()

#Searching for computers that fit the parameters

#————————————————————————————————————————–

Get-ADComputer -Filter {(LastLogonDate -lt $time) -and (Enabled -eq “False”)} -Properties * -ErrorAction SilentlyContinue |

select Name,OperatingSystem,comment,DistinguishedName | foreach {if (($_.OperatingSystem -like “Windows 7*”) -or($_.OperatingSystem -like “Windows 10*”) -or ($_.OperatingSystem -like “Windows 8*”) -or ($_.OperatingSystem -like “Windows xp*”)) {$result+=$_}}

#Write Output to Log

#————————————————————————————————————————–

$result | set-content \\SERVER01\runbook-output\adcleaner\output\ad-disable.csv

#————————————————————————————————————————–

#Delete Function

#————————————————————————————————————————–

foreach ($_ in $result)

{If ($_ -ne $Null)

{Remove-ADObject -Identity $_.DistinguishedName -recursive -Confirm:$false}}

#————————————————————————————————————————–