Here is the scenario – you have AD security groups specifically to DENY services to users that are added to this AD group.
For example – a naughty user could be placed on probation in your organization, and then added to this group – in turn this membership would be automatically disabled in Lync.
Some organization use Deny groups to control access to resources and services. Using this method even if the user was added back into Lync by a Lync administrator, they would be removed again when this command is run – as a scheduled task is best.
Here is an example of PowerShell script to read users within a specific AD Deny group, and then remove those users from Lync membership:
Get-ADGroupMember -Identity YOUR_AD_GROUP| %{ If ($_.objectclass -eq “user”) {Disable-CsUser -Identity $_.name} }
Replace “YOUR_AD_GROUP” with the one you have for your denied users.
You may need to import the AD or Lync module (Import-Module …..) into the PowerShell depending on which server you are logged into running this script.
This can also be used for other services, not just Lync – just modify accordingly.
Lync 2010 / 2013 disabled from AD Deny Groups
by Steve Andrews on November 28th, 2012 | ~ minute read
