Fellow MVP Jeff Guillet wrote an article about the fact that disabling a user’s Active Directory account doesn’t mean they can’t log into Lync/Skype for Business. This is due to the way Lync uses certificates and authentication based on them. I highly recommend you read the article.
I recently was writing some documentation for a customer and wanted to include this important information, including methods for resolving the problem after the fact.
If you’ve not been disabling users in Lync while disabling them in AD, here’s a one liner to find those users:
1 |
Get-CsAdUser -ResultSize Unlimited | Where-Object {$_.UserAccountControl -match "AccountDisabled" -and $_.Enabled -eq $true} | Format-Table Name,Enabled,SipAddress -auto |
You can shorten it somewhat by not checking if $_.Enabled is $true, but just that it exists. You can get a count of the users using:
1 |
Get-CsAdUser -ResultSize Unlimited | Where-Object {$_.UserAccountControl -match "AccountDisabled" -and $_.Enabled} | Measure-Object |
and, if you want, can disable them in one line using
1 |
Get-CsAdUser -ResultSize Unlimited | Where-Object {$_.UserAccountControl -match "AccountDisabled" -and $_.Enabled} | Disable-CsUser |
Update 09-14-2012: Be careful using that last option if you’ve configured test accounts for synthetic testing using the New-CsHealthMonitoringConfiguration cmdlet as I mention in Lync Synthetic Tests: What They are and When They Don’t Work – Part I.
Update 04-12-2014: Replaced aliases with full cmdlet per best practices.
Update 09-19-2014: Added -ResultSize Unlimited