SCORCH : Active Directory Cleanup with Orchestrator

Active Directory Cleanup Runbook Automation

active-directory-monitoring.png

6 runbooks – 5 are functional workbooks and 1st runbook calls the rest in sequence.

Download the Powershell Scripts – ad cleanup runbook ps

 

Runbook 1 – AD Cleanup

The Master Runbook – which triggers every 7 days 16 hours – call the 5 runbooks and they a ‘wait for completion’ before starting the next runbook.

01

02.png

03.png

04.png

05.png

06.png

07.png

 

 

Runbook 2 – Scan and Dump List

Powershell script which scans Active Directory [admin rights not required], check machines which are inactive for 180 days and machine should not be disabled – Operating System = WinXP, Win7 or Win10.

08.png

09

C:\windows\System32\WindowsPowerShell\v1.0\powershell.exe {import-module activedirectory

$DaysInactive = 180

$time = (Get-Date).Adddays(-($DaysInactive))

$result=@()

$result2=@()

#————————————————————————————————————————–

Get-ADComputer -Filter {(Modified -lt $time) -and (useraccountcontrol -ne “4098”)} -Properties * |

select Name,OperatingSystem | foreach {if (($_.OperatingSystem -like “Windows 7*”) -or($_.OperatingSystem -like “Windows 10*”) -or ($_.OperatingSystem -like “Windows 8*”) -or ($_.OperatingSystem -like “Windows xp*”)) {$result+=$_.Name}}

$result | set-content C:\SourceSoftware\runbook-output\adcleaner\output\ad-cleaner.csv}

 

Runbook 3 – Scan and Disable Scheduled Task

Powershell script to Disable machines in AD [requires Admin rights] found in earlier Runbook

10.png

11.png

12.png

13.png

14.png

#Setting search parameters and creating array

import-module activedirectory

$DaysInactive = 180

$time = (Get-Date).Adddays(-($DaysInactive))

$result=@()

#————————————————————————————————————————–

#Searching for computers that fit the parameters

Get-ADComputer -Filter {(LastLogonDate -lt $time) -and (Enabled -eq “True”)} -Properties * -ErrorAction SilentlyContinue |

select Name,OperatingSystem,comment,CN,LastLogonDate,DistinguishedName | foreach {if (($_.OperatingSystem -like “Windows 7*”) -or($_.OperatingSystem -like “Windows 10*”) -or ($_.OperatingSystem -like “Windows 8*”) -or ($_.OperatingSystem -like “Windows xp*”)) {$result+=$_}}

#Disabling computers

#$result|Foreach-Object {Disable-ADAccount -Identity $_.DistinguishedName -recursive -ErrorAction SilentlyContinue}

foreach ($_ in $result)

{If ($_ -ne $Null)

{Disable-AdAccount -Identity $_.DistinguishedName}}

#————————————————————————————————-

 

 

 

Runbook 4 – Scan Disabled and Delete Scheduled Task + Log

Powershell Script to scan for machines inactive for 360 days and disabled, then delete them [required AD Admin rights]

15.png

16

17.png

18.png

19.png

 

#Setting search parameters and creating array

import-module activedirectory

$DaysInactive = 360

$time = (Get-Date).Adddays(-($DaysInactive))

$result=@()

#Searching for computers that fit the parameters

#————————————————————————————————————————–

Get-ADComputer -Filter {(LastLogonDate -lt $time) -and (Enabled -eq “False”)} -Properties * -ErrorAction SilentlyContinue |

select Name,OperatingSystem,comment,DistinguishedName | foreach {if (($_.OperatingSystem -like “Windows 7*”) -or($_.OperatingSystem -like “Windows 10*”) -or ($_.OperatingSystem -like “Windows 8*”) -or ($_.OperatingSystem -like “Windows xp*”)) {$result+=$_}}

#Write Output to Log

#————————————————————————————————————————–

$result | set-content \\SERVER01\runbook-output\adcleaner\output\ad-disable.csv

#————————————————————————————————————————–

#Delete Function

#————————————————————————————————————————–

foreach ($_ in $result)

{If ($_ -ne $Null)

{Remove-ADObject -Identity $_.DistinguishedName -recursive -Confirm:$false}}

#————————————————————————————————————————–

 

 

Runbook 5 – Mail Routine

Send mail with output files to recipients, with subject of today’s date

20.png

2122

The Subject of the mail would be appended with current date and time

23.png

24.png

25

26

 

Runbook 6 – Logging Routine

Moving current logs to history folders and appending with date of file transfer in name.

27.png

28

 

29.png

30.png

31.png

32.png

33.png

34.png

35.png

sample automated email

36

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s