Tips on a spring clean for our Apple Mac Network

[ranj]

Hi

 

Was wondering if I could get some tips on what other schools do when doing a spring clean of the Apple Mac Server.

 

I am looking at simplier ways to do a cleanup of old accounts on our Open directory system on our Apple Macs.

 

I have noticed when I delete a user in workgroup manager it doesnt delete the user Home Directory.

 

Is there a way I can delete a user and it also deletes their home directory?

 

Thanks

[lewiscICT]

I wouldn't mind finding out myself.

 

Currently I run the gauntlet of manually deleting the HomeFolders off my RAID, which is very dull indeed. (after a full Retrospect backup obviously). It would be so much easier if we could get rid of all the student folders but we have to keep students who re-enroll for a further year.

 

I've helped things a bit by creating the shortname of each user to include their WGM UID at the start, whilst keeping the long Studio ID card number as their login name. This does help with the searching of folders but still not great.

 

Would be good to know if there's a quicker way.

[HodgeHi]

Having read this, it spurned me on to take a little look into it. I don't know if you guys have delved into this yourself. If so and you accomplished this how did you do it?

If not then this next little bit of info may be of interest...

 

Using the dscl command against an Active Directory server in the Directory Utilities search path (not sure if you have an integrated setup), you can extract certain information. We will look up the value given to the userAccountControl attribute. This attribute seems to be given a value of 514 if the account is disabled.

 

dscl /Active\ Directory/All\ Domains/ -read /Users/"Name of an AD Account" userAccountControl

 

Replace name of an AD account with a real account name found in your AD.

This will list the value of the userAccountControl for the user specified.

 

It also seems that the dscl command can take variables. So in theory we could look up the account in the AD using the dscl command and if the value = 514 then we could assume the account is disabled and remove/move the home dir.

 

I have a bit of an idea on how to go about this. I am not a brilliant coder/scripter though so there maybe an easier way.

 

We could export the users into a csv file and then create a variable using the username array and feed it into the dscl command where we could list the values of each user's userAccountControl value. Using an if/then ? command we could see if the values match 514 and remove the home dirs.

 

Sound feasible?

Edited September 9, 2010 by HodgeHi

[rolfea]

Having read this, it spurned me on to take a little look into it. I don't know if you guys have delved into this yourself. If so and you accomplished this how did you do it?

If not then this next little bit of info may be of interest...

 

Using the dscl command against an Active Directory server in the Directory Utilities search path (not sure if you have an integrated setup), you can extract certain information. We will look up the value given to the userAccountControl attribute. This attribute seems to be given a value of 514 if the account is disabled.

 

dscl /Active\ Directory/All\ Domains/ -read /Users/"Name of an AD Account" userAccountControl

 

Replace name of an AD account with a real account name found in your AD.

This will list the value of the userAccountControl for the user specified.

 

It also seems that the dscl command can take variables. So in theory we could look up the account in the AD using the dscl command and if the value = 514 then we could assume the account is disabled and remove/move the home dir.

 

I have a bit of an idea on how to go about this. I am not a brilliant coder/scripter though so there maybe an easier way.

 

We could export the users into a csv file and then create a variable using the username array and feed it into the dscl command where we could list the values of each user's userAccountControl value. Using an if/then ? command we could see if the values match 514 and remove the home dirs.

 

Sound feasible?

 

It sounds great, however if you have students that have their accounts disable because of misuse this plan could go a little bit wrong...

 

I was experimenting on a test network using passenger to create all the home areas in yearly folders;

 

Year 10 folder = Year 10 areas

Year 9 folder = Year 9 area

etc

 

Then just delete one folder with all the areas.

 

I have had them time to finish this though, so I can't say it WILL work.