Deleting Leavers from AD and all associated fIles on File Servers

[jimmckenna]

Hi, can anybody offer me directions how you deal with students accounts after leaving. Thinking not only from deleting from AD but also the following:

 

User Profiles

Documents stored on File servers

Office 365 accounts

 

etc etc

 

Many Thanks

[psydii]

Powershell. Read in the properties and delete the profile folder and the home folder.

 

AzureAd Connect will remove the Azure AD account if the original object in AD is deleted. Office365 will delete the associated mailbox and OneDrive. Sharepoint sites/ Office 365 Groups will be orphaned.

 

Here we don't actually delete the AD account ever though because it messes up SIDs on objects. If you want to clear up their Office365 footprint, just remove their licences and wait.

[ITGURU]

Year 11 accounts gets disabled end of August. October half term AD accounts deleted, and data moved to archive for retention period.

[enjay]

Cohort folders in AD and file server, so just delete the entire folder. Azure AD Connect (and GCDS) take care of the rest.

 

The time-consuming bit is the mid-phase leavers, as we currently have to run a SIMS report to identify them then go through and manually delete them.

[ozydave]

Just having a search on Edugeek came across this post.

This powershell script does a good job of finding old home drive folders for uses that no longer are in AD. (would like to say I wrote it by alas I'm not that good)

 

Just rename it to .ps1

Read the top of the script fro lots of options

 

Hope it helps

 

Cheers

Get-OrphanHomeFolder.txt

[mjhardisty]

Much the same to the above. We move users into an "Archive" OU in AD which is outside of the scope of AzureAD Sync and thus in Office365 the user is soft deleted. Soft deletion is useful as it gives some retention time where any account can be restored. Restoring a deleted O365 account where the AD account is outside the AzureAD scope will create a Cloud-Only user rather than a federated user.

Documents on local file servers are retained. These are eventually archived out during our yearly routines to remove files from primary to secondary storage based upon last-accessed dates. Again, useful if any request for data is made after the deletion dates.

[Garacesh]

We separate users based on year group, both in AD and on our file server.

At the end of the academic year, we disable every account in $LeaverOU. Those get to sit there for a year, just in case any kid needs their coursework for college etc.

Once they're disabled, G Suite and 365 disable the accounts on the next sync (Azure AD Connect does this automatically, Google uses an LDAP query that includes (!(userAccountControl:1.2.840.113556.1.4.803:=2)) so administratively disabled users don't match). GCDS doesn't delete non-matched users in G Suite because we've told it not to, so I also have to delete those manually, and as long as the user still exists in AD, Azure AD Connect won't delete them from 365.

Next year, when we come to disable the leavers, we take the opportunity to delete last year's leavers, and remove all their files, which is simply just a case of 'delete the root folder'

 

As for mid-year leavers, we disable the user account and slap information about them leaving (Off-roll xx/xx/xxxx, excluded xx/xx/xxxx, etcetera) into the Description field.

There's so few and far between of these that we just let them sit there, and delete them and their user areas/etc when we come to delete the rest of the year group once they progress beyond Year 11.

 

As for user profiles, we don't do roaming, so they're just stored locally on the machines they log in to. We generally don't bother doing anything with those. They'll disappear when the GPO profile age threshold kicks in. Well, that, and we do mass-reimaging every summer.

Edited March 24, 2022 by Garacesh

[Disease]

We disable year 11 accounts on their last day, keep their files until around November ( until after the exam appeals deadline) before we then Zip Archive it and store for a year and delete the original files.

 

Staff we delete on the day they leave.

Edited March 24, 2022 by Disease

[enjay]

GCDS doesn't delete non-matched users in G Suite because we've told it not to, so I also have to delete those manually

 

Careful. Doesn't that also delete any files they'd created and shared with other users?

[Garacesh]

Yes, but if nobody has noticed after a year..

 

We encourage team drive use where possible, which avoids that issue.

[enjay]

Yes, but if nobody has noticed after a year..

 

We encourage team drive use where possible, which avoids that issue.

 

Maybe everyone has migrated to Team Drives?? We disable rather than delete in Google (staff, anyway) as we never set up Team Drives. Google was only really being used for Classroom, have now migrated to SharePoint/Teams instead which we're managing better.