IT Admin Tips: Automatically Logout Disabled User Account

Last week's article went over the steps of how to create a solution to determine the computer(s) a user logs into automatically. While this can be very useful information to have by itself, it also opens the door for other possibilities. One such possibility would be to have an automated process that forces a user to be automatically logged off of their computer(s) in the event that their domain account is disabled by an administrator.

The following will outline the solution to have a user's domain account be logged off of any computer(s) that they are currently logged into utilizing a scheduled PowerShell script. This process has been designed to work on Windows Server 2008 and later versions.

The first part of the PowerShell script should look similar to what was used in the Creating AD User Account Alerts article, as we will also need to get the most recent instance of Event ID 4725 which is caused from a domain account being disabled.

$Event = Get-EventLog -LogName Security -InstanceId 4725 -Newest 1

With the most recent instance of this Event ID, we now need to parse out the domain account name that has been disabled and then store it into a usable variable.

[String]$String = $Event.ReplacementStrings
$UserName = ($String).split()[0]

Next, we need to get the corresponding Distinguished Name of this user account from Active Directory.

$DN = dsquery user -samid $UserName
$DN = $DN -replace '"',""

Using this information, we can now query the ManagedBy attribute within Active Directory in order to determine what computer(s) this particular user is currently logged into.

$ComputerDNs = dsquery * -filter "(&(objectCategory=computer)(managedBy=$DN))"
ForEach ($ComputerDN in $ComputerDNs)
{
    $Computers+= ($ComputerDN -split ",")[0].substring(4) + ","
}

Due to how we have extracted this information, we now need to perform some cleanup of the output so that we have a usable Array containing the computer(s).

$Computers = $Computers.Split(",",[System.StringSplitOptions]::RemoveEmptyEntries)

With all of this information, we can now loop through the list of computers that this user is logged into and force their logoff.

ForEach ($Computer in $Computers)
{
    IF (Test-Connection -ComputerName $Computer -Count 4 -Quiet)
    {
        (gwmi win32_operatingsystem -ComputerName $Computer).Win32Shutdown(4)
        $SuccessList+= $Computer + "<br/>"
    } ELSE
    {
        $FailList+= $Computer + "<br/>"
    }
}

As a final touch, let's setup an E-Mail confirmation that will let yourself, and any other administrators, know what computer(s) this user has been logged off of, along with any that were unreachable (e.g. not connected to the network).

$Body = @"
The Domain User $UserName has been successfully logged out of the following computer(s): <br/>
$SuccessList <br/>
The Domain User $UserName has NOT been logged out of the following computer(s), please verify: <br/>
$FailList <br/>
"@
Send-MailMessage -to "[Your E-Mail Address or Distribution List]" -from "[UserID Running the Scheduled Task]" -subject "Disabled User Logged Out of Computer(s)" -body $Body -SmtpServer [SMTP Server IP] -BodyAsHTML

When it is all put together, your PowerShell script should look something like this.

$Event = Get-EventLog -LogName Security -InstanceId 4725 -Newest 1

[String]$String = $Event.ReplacementStrings
$UserName = ($String).split()[0]

$DN = dsquery user -samid $UserName
$DN = $DN -replace '"',""

$ComputerDNs = dsquery * -filter "(&(objectCategory=computer)(managedBy=$DN))"
ForEach ($ComputerDN in $ComputerDNs)
{
    $Computers+= ($ComputerDN -split ",")[0].substring(4) + ","
}

$Computers = $Computers.Split(",",[System.StringSplitOptions]::RemoveEmptyEntries)

ForEach ($Computer in $Computers)
{
    IF (Test-Connection -ComputerName $Computer -Count 4 -Quiet)
    {
        (gwmi win32_operatingsystem -ComputerName $Computer).Win32Shutdown(4)
        $SuccessList+= $Computer + "<br/>"
    } ELSE
    {
        $FailList+= $Computer + "<br/>"
    }
}

$Body = @"
The Domain User $UserName has been successfully logged out of the following computer(s): <br/>
$SuccessList <br/>
The Domain User $UserName has NOT been logged out of the following computer(s), please verify: <br/>
$FailList <br/>
"@
Send-MailMessage -to "[Your E-Mail Address or Distribution List]" -from "[UserID Running the Scheduled Task]" -subject "Disabled User Logged Out of Computer(s)" -body $Body -SmtpServer [SMTP Server IP] -BodyAsHTML

Just like with the previous article on Creating AD User Account Alerts, you will now need to schedule this PowerShell script within Task Scheduler on your Active Directory server using a Domain Account with the appropriate access. In order for this script to execute immediately whenever a user account is created, and therefore log them out of any computer(s) they are logged into, you will need to configure the task to be triggered whenever Security Event ID 4725 occurs.

By creating this PowerShell script and scheduling it to run on your Active Directory server, you now have an automated solution in-place to logoff any disabled domain accounts from the computer(s) that they are logged into. You also have an E-Mail that will be sent to you whenever this script is triggered to notify you of the computer(s) that the domain account was logged off of, along with any that were unreachable at the time of execution. While this should not be used as a replacement for proper business practices for employee termination, it can be a helpful backup for instances where their domain account has been disabled before corporate security, human resources, or their direct manager have made it to their desk in order to escort them out.

Read More

IT Admin Tips: Determine the Computer(s) a User Logs Into Automatically

While there are various solutions on the market that will allow you to extend your visibility into your domain, it is not always feasible to introduce a new product into your setup. In many cases, what you have now is what you will have for quite some time. That being the case, it is crucial to be able to leverage existing technologies in ways that can provide additional benefits for yourself, and other system administrators. One such example is being able to see what user is currently logged into a domain computer. While you can manually query this information via WMIC and QWINSTA, it is typically more beneficial to have this information automatically populated somewhere for you to quickly view when needed.

The following steps will guide you through the process of setting up a solution to have a user's username automatically populate within the ManagedBy attribute within Active Directory whenever they log into their computer.

I. Delegate Control for Domain Users
The first thing you will need to do is to configure Domain Users with the ability to Write to the ManagedBy attribute within Active Directory. For Windows Server 2008 and 2008 R2, this can be accomplished by following the steps outlined below.

  1.) Launch Active Directory User and Computers
  2.) Right-Click on the OU containing your Domain Computers
  3.) Select Delegate Control
  4.) Click Next
  5.) Add "Domain Users"
  6.) Click Next
  7.) Select "Create a custom task to delegate"
  8.) Click Next
  9.) Select "Only the following objects in the folder"
  10.) Select "Computer objects"
  11.) Click Next
  12.) Select the checkbox for "Property-specific"
  13.) Select "Read Managed By" and "Write Managed By"
  14.) Click Next
  15.) Click Finish

II. Create a Logon Script
Now that Domain Users have permission to Write to the ManagedBy, you will need to create a way for their Username to be automatically written to this attribute. For this, you can use the following VBScript code.

  Set objSysInfo = CreateObject("ADSystemInfo")
  
  On Error Resume Next
  Set objComputer = GetObject("LDAP://" & objSysInfo.ComputerName)
  
  objComputer.Put "managedBy", objSysInfo.Username
  objComputer.SetInfo

III. Creating a GPO to Deploy Logon Script
Finally, you can wrap this all together by creating a new Group Policy Object in order to deploy the VBScript as a Logon Script. Again, the following steps should work on Windows Server 2008 and 2008 R2.

  1.) Launch the Group Policy Management application
  2.) Create a new GPO linked to an OU containing your Users
  3.) Note the Unique ID for this new GPO
  4.) Copy your VBScript file into the corresponding Scripts directory, using the GPO's Unique ID.

Example: \sysvol\[DOMAIN NAME]\Policies\{UNIQUE POLICY ID}\User\Scripts\Logon
  5.) In the Group Policy Management Editor for your new GPO, navigate to:

User Configuration -> Policies -> Windows Settings -> Scripts (Logon/Logoff)
  6.) Double-Click on Logon
  7.) Click Add
  8.) Click Browse and select your new Logon Script
  9.) Click OK and Apply the new script

With this solution in-place, you can now query Active Directory in order to see who is currently logged into a domain computer. While this may not be as "snazzy" as what you might have with some sort of paid-for solution, this process won't set you back any money whatsoever, nor does it take very long to setup.

Read More

IT Admin Tips: Creating AD User Account Alerts

Having visibility into the changes going on within your systems can be critical for an IT professional, especially when it comes to your Active Directory system. I have come up with a quite simple, and very useful, setup that sends an automated alert whenever a User Account is Disabled, Created, or added to a Domain Group. This can help out whenever you have multiple individuals with access to perform these changes within Active Directory, as it will alert you immediately whenever it is performed, and it will provide insight into who has made the change.

In order to configure this setup, you should be familiar with Windows Task Scheduler, and you will need access to a Domain Account with the following:
     - Ability to schedule tasks on your Active Directory server
     - Read access to your Active Directory server's Event Logs
     - A corresponding E-Mail address from which you can send the alerts

Account Created Alert
In order to configure the alert for when a user account is created, you must first create the following PowerShell script:

$Event = Get-EventLog -LogName Security -InstanceId 4720 -Newest 1
$MailBody= $Event.Message + "`r`n`t" + $Event.TimeGenerated
send-mailmessage -from "[UserID Running the Scheduled Task]" -to "[Your E-Mail Address or Distribution List]" -subject "User Account was Created" -body $MailBody -smtpServer [SMTP Server IP]

Once this has been created, you can schedule it within Task Scheduler on your Active Directory server using a Domain Account with the appropriate access (listed above). Ideally, this account would be some sort of "service" account and not associated with a particular IT Admin. In order for this alert to be sent out immediately whenever a user account is created, you will need to configure the task to be triggered whenever Security Event ID 4720 occurs. This is key, as the above PowerShell script will send you an E-Mail with the content of the most recent instance of this Event ID. This will contain the user account that has been created, along with the administrative account that created it.

Account Added to Domain Group Alert
In order to configure the alert for when a user account is added to a Domain Group, you must first create the following PowerShell script:

$Event = Get-EventLog -LogName Security -InstanceId 4728 -Newest 1
$MailBody= $Event.Message + "`r`n`t" + $Event.TimeGenerated
send-mailmessage -from "[UserID Running the Scheduled Task]" -to "[Your E-Mail Address or Distribution List]" -subject "User Account was added to a Domain Group" -body $MailBody -smtpServer [SMTP Server IP]

Just like with the previous alert, you can now schedule it within Task Scheduler on your Active Directory server using the same Domain Account as before. In order for this alert to be sent out immediately whenever a user account is created, you will need to configure the task to be triggered whenever Security Event ID 4728 occurs. Just like with the previous alert, This is a key step. This particular alert will contain the user account that was added to a group, the corresponding domain group, and the administrative account that added it.

Account Disabled Alert
In order to configure the alert for when a user account is disabled, you must first create the following PowerShell script:

$Event = Get-EventLog -LogName Security -InstanceId 4725 -Newest 1
$MailBody= $Event.Message + "`r`n`t" + $Event.TimeGenerated
send-mailmessage -from "[UserID Running the Scheduled Task]" -to "[Your E-Mail Address or Distribution List]" -subject "User Account was Disabled" -body $MailBody -smtpServer [SMTP Server IP]

Just like with the previous two alerts, you can now schedule it within Task Scheduler on your Active Directory server using the same Domain Account as before. In order for this alert to be sent out immediately whenever a user account is created, you will need to configure the task to be triggered whenever Security Event ID 4725 occurs. As with the other alerts, this is important. This particular alert will contain the user account that was disabled, and the administrative account that disabled it.

If you have followed these steps correctly, you will now be able to receive E-Mail alerts whenever someone Creates a new Domain Account, adds an existing one to a Domain Group, or Disables an existing account.

NOTE: If you receive an error stating that "File cannot be loaded because the execution of scripts is disabled on this system" while testing your scheduled script, you will need to manually run the following PowerShell command in order to allow this feature:

Set-ExecutionPolicy Unrestricted

Read More