ex pupils and staff accounts

[mikeymike]

Just a quick one on how long do you keep pupils and staff accounts on the network for after they have left your workplace???

[fafster]

We transfer old work to DVD for archiving. I don't think DVDs last longer than ten years, but it's unlikely that any ex-pupils will want the work after two or three.

[stratisphere]

We deactivate accounts as soon as they leave and move them to an Archive OU. We then keep the accounts & files for a year. After that we delete them. If they need them after that it's a visit to our backups (after a short talk of "you should have got it when you left")

[Dom_]

Student accounts is usually 2 years for us as we have a 6th form, the data has to stay for 3 years i think?

 

Staff, depends on if they are supply or full time, supply we keep in a seperate container as they could come back, normal staff we usually leave for a month or clean up over 6 week hols.

[localzuk]

A year for pupil data, no specific time for staff data. It varies on who the staffmember was. If it was, for example, the old office manager or the like then they stay forever (I spose the entire lot should really be moved into the new postholder's account but oh well), whereas if it's a TA then it goes pretty quickly - usually within a few months.

 

Accounts are disabled as soon as they leave for both staff and pupils.

Edited January 7, 2009 by localzuk
added account disable details

[Zimmer]

Staff personal storage space (Home Folder) and email .PST is kept on a spare file server for 6 months after HR have informed us of their last day. After that they get purged and the Active Directory account deleted.

 

Student data is kept on tape for 12 months with the regular backup jobs - no additional storage is done.

 

We keep all staff and student logon/logoff log files for 12 months.

 

With students that have left we also keep the ISA Internet logs for 3 months too, I'd like to keep more but unfortunately storage is starting to get stupidly large!

[Psymon]

We keep all leaver personal storage areas on a NAS drive, keep the account in AD (Disabled) for 1year, then remove (along with mailbox).

 

The data is kept on the backup drive indefinately at current, once space is tight on the NAS we will start cycling it.

 

Si

[elsiegee40]

Accounts disabled immediately. Home drive archived after about 3 months. Entire account disposed of after 12 months with permission from HT. Edited January 7, 2009 by elsiegee40

[stu1892]

Without me starting a new thread (yet! )

 

Has anyone got any tips on deleting users and home folders together?

 

I inherited a system with a load of inactive users and their home folders / documents.

 

On further inspection there seems to be some users without home folders thanks to them not being deleted when there was a migration. Also, some home folders exist that no longer have a user.

 

As you can imagine, it's a bit of a mess at the moment and i don't know where to start without doing it manually:(

 

Regards.

[Tamarside]

On Win32 Scripting.... Everything you need to get up and running you will find a script to delete orphaned home folders, plus a whole lot more!

 

That specific script works a treat!

[robk]

Without me starting a new thread (yet! )

 

Has anyone got any tips on deleting users and home folders together?

 

I inherited a system with a load of inactive users and their home folders / documents.

 

On further inspection there seems to be some users without home folders thanks to them not being deleted when there was a migration. Also, some home folders exist that no longer have a user.

 

As you can imagine, it's a bit of a mess at the moment and i don't know where to start without doing it manually:(

 

Regards.

 

 

I have a bit of scripting that creates home directories from ou`s and moves old homedirectories if the user does not exist. How are your homedirectories organised?

 

Robk

[Zimmer]

We remove our staff accounts manually, as it is only ever a couple a month or so.

 

Due to us having approximately 14000 student accounts in AD at any given time we have no choice but to VB script the account generation and deletion process.

 

I can't give you our script as it would require far to much modification to get it to work on another network. But as said by Tamarside you could probably knock up a quick VB script that will plod through AD and clock user accounts, orphan Home Folders can then be processed as you wish.

 

ADDED:

 

Just because I'm really nice here is a VB script you can use that will find all orphan Home Folders (We call them Z Drives by the way) and delete/move them. It will also compile a .CSV list for you at the same time. Please note that all network locations here are DFS shares but the script will work just as well with UNC paths

 

Dim objFSO

Dim objFolder

Dim objSub

Dim intAge

 

Set objFSO = CreateObject ("Scripting.FileSystemObject")

Set objFolder = objFSO.GetFolder ("\\yourdomain.ac.uk\studentusers$")

Set objtxtfile = obJFSO.CreateTextFile ("orphaned.csv")

For Each objSub in objFolder.SubFolders

strUserPath = FindUser (objSub.Name)

strName = "NO ACCOUNT IN A.D."

If strUserPath <> "USER NOT FOUND" Then

Set objUser = GetObject (strUserPath)

strName = objUser.displayName

End If

 

'::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

':::CReate text file of Orphaned Z drives & Move Z Drive:::

'::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

On Error Resume Next

If strName = "NO ACCOUNT IN A.D." Then

If Not objsub.Name = "YDRIVE$" or objsub.Name = "modofficefiles$" Then <--- IGNORE THIS LINE FOR YOUR NETWORK!!!!

objtxtfile.writeline objSub.Name

objFSO.CopyFolder ("\\yourdomain.ac.uk\studentusers$\") & objSub.Name, ("\\yourdomain.ac.uk\orphanedZdrives$\")

objFSO.DeleteFolder ("\\yourdomain.ac.uk\studentusers$\") & objSub.Name, TRUE

End If

End If

 

Next

MsgBox "Done"

WScript.Quit (0)

 

 

Function FindUser(strUser)

Dim objDomain

Dim oConnection

Dim oRecordset

Dim strQuery

 

Set objDomain = GetObject ("LDAP://DC=yourdomain, DC=ac, DC=uk")

Set oConnection = CreateObject("ADODB.Connection")

Set oRecordset = CreateObject("ADODB.Recordset")

oConnection.Provider = "ADsDSOObject"

oConnection.Open "ADs Provider"

 

strQuery = "<" & objDomain.ADsPath & ">;(&(objectClass=user)(samaccountname=" & strUser & "));adspath;subtree"

Set oRecordset = oConnection.Execute(strQuery)

 

if Not oRecordset.EOF Then

FindUser = Replace (oRecordset.Fields(0).Name & ": " & oRecordset.Fields(0), "adspath: ", "")

Else

FindUser = "USER NOT FOUND"

End If

End Function

Edited January 7, 2009 by Zimmer

[Pottsey]

Accounts get disabled a year after they have gone. Sometimes sooner if the username is needed by someone else. So far accounts have never been deleted. All homefolders are stored/archived.

[stu1892]

Thanks robk / tamarside.

 

i'm new to scripting and i'm struggling to get one working. It just flashes up with a command prompt and instantly closes. This is the script i'm trying to run.

[robk]

Thanks robk / tamarside.

 

i'm new to scripting and i'm struggling to get one working. It just flashes up with a command prompt and instantly closes. This is the script i'm trying to run.

 

That script seems a bit over complicated, but should work. I am guessing you are double clicking the script? for debuging if you do the following you should be able to see the error message (or other output).

 

open a command prompt (start/run/type cmd)

cd to the directory the script is in

enter cscript

 

You should be able to see whats going on.

 

Robk

[stu1892]

Cheers Rob.

 

new to this scripting lark. That worked. 230 orphaned home folders. not too bad i guess.

 

Now to delete them manually!

[jcollings]

We delete staff accounts the week after they leave (or in September if they leave over summer) but archive stuff to DVD.

 

Students get deleted at the end of the academic year (usually the last week in August) and again are archived to DVD.

 

The DVDs are stored until I get round to a clear out but for a min of 3 years in case exam boards want work etc.

[Sylv3r]

Student accounts are deleted straight away after a backup of all documents.

 

Students entering our sixth form do not carry forward their Year 7 - 11 work. I create new accounts for them.

 

When staff leave they get a copy of all their work on CD / DVD - floppy disk for some! Their accounts are disabled and deleted after a backup and 6 months have passed.

[grumpy_git]

Immediately staff leave we put them in a "leavers" folder and disable the account. We send out a memo a few weeks before they leave asking them to give files to successors etc. After a while and a backup we delete them. The exception is if they aren't really leaving - a couple of retired teachers do supply work, as does one of the office ladies.

 

Students, we're very often not told about (despite the introduction of a ticklist for HOYs to use) until they have been gone some time. I try to do a termly comparison of a list of users against a copy of the school roll. Year 11s/13s we get rid of if they don't come back in September. Keeping all accounts frozen until Christmas and disposing around then (which reminds me I've not done it this year yet!).

[srochford]

Cheers Rob.

 

new to this scripting lark. That worked. 230 orphaned home folders. not too bad i guess.

 

Now to delete them manually!

 

Aaaarrrrgh :-)

 

You've got this far with the script, just take a bit of time to get the rest of it done!

The key bit is here:

   If strADPres = "Present" Then
       EchoAndLog Date & "," & Time & "," & strUNCStart & "\" & objSubFolder.Name & "," & "Folder/User is ok."
   Else
       EchoAndLog Date & "," & Time & "," & strUNCStart & "\" & objSubFolder.Name & "," & "Folder/User is bad. User Not Found!"
   End If

This is writing to the log file the good/bad folders so you just want to add something to delete the bad folders - it could be as simple as:

objfso.deletefolder(strUNCStart & "\" & objSubFolder.Name)

added after the "else" or (to be safer!) you can do

objfso.movefolder strUNCStart & "\" & objSubFolder.Name strUNCStart & "\archive\"

(make sure you have a folder called archive under the root of the home folders - eg if the server has d:\home\user1, d:\home\user2 etc then make a d:\home\archive)

 

This isn't perfect - the next time you run it, it will try and delete the archive folder - but I'm afraid I've not got time to work out how to specify a better location in that script. I'm sure that by the time you need it again your scripting will be good enough :-)

[stu1892]

   If strADPres = "Present" Then
       EchoAndLog Date & "," & Time & "," & strUNCStart & "\" & objSubFolder.Name & "," & "Folder/User is ok."
   Else
       EchoAndLog Date & "," & Time & "," & strUNCStart & "\" & objSubFolder.Name & "," & "Folder/User is bad. User Not Found!"
objfso.movefolder strUNCStart & "\" & objSubFolder.Name strUNCStart & "\archive\"
    End If

 

Hope i've done that right.

 

I'm getting an expected end of statement here, (where the bold starts)

 

objfso.movefolder strUNCStart & "\" & objSubFolder.Name strUNCStart & "\archive\"

 

I'm guessing the one of the statements need to be in brackets???

[srochford]

sorry; shouldn't type stuff late at night when I can't test the code!

 

objfso.movefolder strUNCStart & "\" & objSubFolder.Name, strUNCStart & "\archive\"

 

I missed a comma missing between the source and destination.

 

You don't need brackets with movefolder; you do need them with deletefolder and I don't know why :-(

 

These are links to the MSDN item on deletefolder and movefolder - they have examples and docs.

[stu1892]

Cheers Steve.

 

It worked up until the next orphaned folders beginning with 'B'!.

 

It looks like it's stopping with the archive folder. I'll need to move where the archive folder is. as it's checking the archive folder as a home directory.

 

Thanks to the technicians i inherited these users from, there's a load of users that still exist but their usernames have been changed and home folders left the way they were

Edited January 8, 2009 by stu1892