Mike Swanson
5cbd49ce24
Move 150+ scripts from root and scripts/ into client/project directories: - clients/dataforth/scripts/ (110 files: AD2, sync, SSH, DB, DOS scripts) - clients/bg-builders/scripts/ (14 files: Lesley mgmt, Exchange, termination) - clients/internal-infrastructure/scripts/ (10 files: GDAP, Gitea, backups) - projects/msp-tools/scripts/ (9 files: CIPP, MSP onboarding, Datto) - projects/gururmm-agent/scripts/ (3 files: API test, JWT, record counts) - clients/glaztech/scripts/ (1 file: CentraStage removal) Also reorganized: - VPN scripts → infrastructure/vpn-configs/ - Retrieved API/JS files → api/ - Forum posts → projects/community-forum/forum-posts/ - SSH docs → clients/internal-infrastructure/docs/ - NWTOC/CTONW docs → projects/wrightstown-smarthome/docs/ - ACG website files → projects/internal/acg-website-2025/ - Dataforth docs → clients/dataforth/docs/ - schema-retrieved.sql → docs/database/ Deleted 24 tmp_*.ps1 one-off debug scripts (preserved in git history). Root reduced from 220+ files to 62 items (docs + directories only). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
103 lines
4.2 KiB
PowerShell
103 lines
4.2 KiB
PowerShell
# BG Builders - Disable Lesley Roth + Wipe Email from Device
|
|
# Employee: Lesley Roth (lesley@bgbuildersllc.com)
|
|
# Date: 2026-03-09
|
|
# Actions:
|
|
# 1. Block sign-in
|
|
# 2. Revoke all sessions
|
|
# 3. Reset password
|
|
# 4. Wipe email data from mobile devices (selective wipe + EAS wipe)
|
|
|
|
$ErrorActionPreference = "Stop"
|
|
$tenantId = "ededa4fb-f6eb-4398-851d-5eb3e11fab27"
|
|
$lesleyUPN = "lesley@bgbuildersllc.com"
|
|
|
|
Write-Output "========================================="
|
|
Write-Output " BG Builders - Disable Lesley Roth"
|
|
Write-Output " $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')"
|
|
Write-Output "========================================="
|
|
|
|
# --- STEP 1: Connect to Microsoft Graph ---
|
|
Write-Output "`n[STEP 1] Connecting to Microsoft Graph..."
|
|
Import-Module Microsoft.Graph.Authentication
|
|
Import-Module Microsoft.Graph.Users
|
|
Import-Module Microsoft.Graph.Users.Actions
|
|
Connect-MgGraph -TenantId $tenantId -Scopes 'User.ReadWrite.All','Directory.ReadWrite.All','DeviceManagementManagedDevices.ReadWrite.All','DeviceManagementManagedDevices.PrivilegedOperations.All' -NoWelcome
|
|
Write-Output "[OK] Connected to Graph"
|
|
|
|
$lesley = Get-MgUser -UserId $lesleyUPN -Property Id,DisplayName,AccountEnabled,AssignedLicenses
|
|
Write-Output "[INFO] Current state: AccountEnabled=$($lesley.AccountEnabled)"
|
|
|
|
# --- STEP 2: Block sign-in ---
|
|
Write-Output "`n[STEP 2] Blocking sign-in..."
|
|
Update-MgUser -UserId $lesley.Id -AccountEnabled:$false
|
|
Write-Output "[OK] Sign-in blocked"
|
|
|
|
# --- STEP 3: Revoke all sessions ---
|
|
Write-Output "`n[STEP 3] Revoking all active sessions..."
|
|
Revoke-MgUserSignInSession -UserId $lesley.Id
|
|
Write-Output "[OK] All sessions revoked"
|
|
|
|
# --- STEP 4: Reset password ---
|
|
Write-Output "`n[STEP 4] Resetting password..."
|
|
$newPassword = -join ((65..90) + (97..122) + (48..57) + (33,35,36,37,38) | Get-Random -Count 24 | ForEach-Object {[char]$_})
|
|
$params = @{
|
|
passwordProfile = @{
|
|
forceChangePasswordNextSignIn = $true
|
|
password = $newPassword
|
|
}
|
|
}
|
|
Update-MgUser -UserId $lesley.Id -BodyParameter $params
|
|
Write-Output "[OK] Password reset to random value"
|
|
|
|
# --- STEP 5: Wipe email from devices (Intune managed) ---
|
|
Write-Output "`n[STEP 5] Checking for Intune-managed devices..."
|
|
Import-Module Microsoft.Graph.DeviceManagement
|
|
$devices = Get-MgDeviceManagementManagedDevice -Filter "userPrincipalName eq '$lesleyUPN'" 2>$null
|
|
if ($devices) {
|
|
foreach ($device in $devices) {
|
|
Write-Output " Found: $($device.DeviceName) ($($device.OperatingSystem)) - ID: $($device.Id)"
|
|
Write-Output " Initiating selective wipe (company data only)..."
|
|
Invoke-MgRetireDeviceManagementManagedDevice -ManagedDeviceId $device.Id
|
|
Write-Output " [OK] Selective wipe queued for $($device.DeviceName)"
|
|
}
|
|
} else {
|
|
Write-Output "[INFO] No Intune-managed devices found"
|
|
}
|
|
|
|
# --- STEP 6: Wipe email from devices (Exchange ActiveSync) ---
|
|
Write-Output "`n[STEP 6] Connecting to Exchange Online..."
|
|
Import-Module ExchangeOnlineManagement
|
|
Connect-ExchangeOnline -UserPrincipalName "sysadmin@bgbuildersllc.com" -ShowBanner:$false
|
|
Write-Output "[OK] Connected to Exchange Online"
|
|
|
|
Write-Output "Checking for ActiveSync devices..."
|
|
$easDevices = Get-MobileDevice -Mailbox $lesleyUPN 2>$null
|
|
if ($easDevices) {
|
|
foreach ($eas in $easDevices) {
|
|
Write-Output " Found EAS device: $($eas.FriendlyName) ($($eas.DeviceOS))"
|
|
Clear-MobileDevice -Identity $eas.Identity -AccountOnly -Confirm:$false
|
|
Write-Output " [OK] Account-only wipe initiated for $($eas.FriendlyName)"
|
|
}
|
|
Write-Output "[OK] All EAS devices queued for account wipe"
|
|
} else {
|
|
Write-Output "[INFO] No EAS mobile devices found"
|
|
}
|
|
|
|
# --- DONE ---
|
|
Write-Output "`n========================================="
|
|
Write-Output " DISABLE + DEVICE WIPE COMPLETE"
|
|
Write-Output " $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')"
|
|
Write-Output "========================================="
|
|
Write-Output ""
|
|
Write-Output "Summary:"
|
|
Write-Output " [OK] Sign-in blocked"
|
|
Write-Output " [OK] Sessions revoked"
|
|
Write-Output " [OK] Password reset"
|
|
Write-Output " [OK] Device email wipe initiated (Intune + EAS)"
|
|
Write-Output ""
|
|
Write-Output "[INFO] Mailbox is still accessible - run full termination script"
|
|
Write-Output " when ready to convert to shared, remove license, etc."
|
|
|
|
Disconnect-ExchangeOnline -Confirm:$false
|
|
Disconnect-MgGraph
|