User Table

Gordon_Kenmuir

Has anyone undertaken clean up of the user records in Service Manager. We have almost 10k user records in SCSM, but only 2k in AD, and of those, only 1k active. It causes issues for user look ups and agents sometime select the wrong ones. Curious if anyone has any powershell for this, that maybe looks for associated CIs, compares against, AD, etc?

Or does everyone just let it grow and grow?

Simon_Zeinhofer

Hello @Gordon_Kenmuir ,

you could ask your sysadmins, if they give your connector account access to the AD recycle bin. Microsoft stated, that this enables the connector to delete old record automatically.

Alterantively you could use this script:

$scsm = 'YOURSERVER'
$class = Get-SCSMClass -Name 'Microsoft.AD.User$' -ComputerName $scsm
$toDeleteUsersSCSM = [System.Collections.ArrayList]::new()

#we had to add the pipeline, as we also deleted users, which were created from teh connector (sent a mail to the connector address but had no user in scsm)
$users = Get-SCSMObject -Class $class -ComputerName $scsm | Where-Object { ($_.FQDN -eq 'YOURFQDN') -or ($_.DisplayName -like "SOME USERS IN OUR ORG HAVE THIS AS A PREFIX*") }

foreach ($u in $users) {
    try {
        $adUser = Get-aduser -Identity $u.UserName
    }
    catch {
        $toDeleteUsers.Add($u)
    }
}


foreach ($t in $toDeleteUsersSCSM) {
    Remove-SCSMObject -SMObject $t -ComputerName $scsm -Force
}

We have this script running every night to clean up our user objects.

I shortened it a bit, as we use it a bit differently - That's why I first add these users to an arraylist and afterwards delete them. You could just move the delete to the catch phrase, but that's up to you.

You also have to be sure to import the ACtive Directory Module first, else this won't work.

Gordon_Kenmuir

Awesome, thanks

Jeff_Lang

We extended the User Class to have fields for Disabled, NoLongerInAd amongst others, and update these fields every night, so we can them limit the portal down to only selecting those users where these are NOT set.

Gordon_Kenmuir

@Jeff_Lang that sounds like a better approach, is that a native feature of the portal, to limit down the names? or is that custom?

Jeff_Lang

There is a field in the admin settings which you could use to limit them down, but we do not use this one for it, as sometimes we do want people to be able to select one of those users, eg if one has been disabled in AD for some reason, they still need to be able to select them for a request to get the username in AD reenabled.

We tend to just set which ones not to select on each request offering, and replace the default criteria on most user selections on normal pages.

It was a bit of a pain to get right though, and not something that is easily transferable to others as it is specific to what we required

Gordon_Kenmuir

Awesome Jeff, thanks