powershell - 阻止批量用户帐户

Question

有什么方法可以通过 EmployeeID 而不是 UPN 在 Office365 中阻止用户帐户？

这是我尝试过的脚本，但它只能被 UPN 阻止：

Import-Csv 'C:\BlockedUsers.csv' | ForEach-Object {
$upn = $_."UserPrincipalName"
Set-MsolUser -UserPrincipalName $upn -BlockCredential $true
}

Answer 1

如果您的 csv 文件包含名为 的列EmployeeId，则可以使用该Get-AdUsercmdlet 来获取 UserPrincipalName 属性：

Import-Csv 'C:\BlockedUsers.csv' | ForEach-Object {
    $user = Get-ADUser -Properties EmployeeID -Filter "EmployeeID -eq $($_.EmployeeID)"
    if ($user) {
        $upn = $user.UserPrincipleName
        Set-MsolUser -UserPrincipalName $upn -BlockCredential $true
    }
}

---

编辑

从您的评论来看，该EmployeeID属性似乎在您的组织中并不总是独一无二的。

在这种情况下，下面的代码应该能够处理

Import-Csv 'C:\BlockedUsers.csv' | ForEach-Object {
    $user = Get-ADUser -Properties EmployeeID -Filter "EmployeeID -eq $($_.EmployeeID)"
    if ($user) {
        foreach ($usr in $user) {
            Write-Host "Blocking user $($usr.Name)"
            $upn = $usr.UserPrincipleName
            Set-MsolUser -UserPrincipalName $upn -BlockCredential $true
        }
    }
    else {
        Write-Host "User with EmployeeID $($_.EmployeeID) not found"
    }
}

PS 如果您的 CSV 可以包含该列的空值，EmployeeID请将第一行更改为

Import-Csv 'C:\BlockedUsers.csv' | Where-Object {$_.EmployeeID -match '\S'} | ForEach-Object {

摆脱空值或仅空白值。

---

编辑

如果您确定您的 CSV 包含一列EmployeeId并且您没有将其误认为是 AD 属性EmployeeNumber，那么这可能对您有用。
它用于Get-ADUser获取在其 EmployeeId 属性中实际包含Where-Object某些内容的用户对象的集合，并通过与您使用.

EmployeeId和都是EmployeeNUmberAD 类型的属性String。你可以在这里查看

# first read the CSV into an array containing only the values from the 'EmployeeID' column
$blockedUserIds = Import-Csv 'C:\BlockedUsers.csv' | Select-Object -ExpandProperty EmployeeId -Unique

# next get an array of user objects that have something in the EmployeeID attribute and only
# leave the users where the attribute can be matched to a value captured in the CSV array above
# use the '@(..)' syntax to force the result to be an array, even if only one item is found
$usersToBlock = @(Get-ADUser -Properties EmployeeID, Name, UserPrincipalName -Filter "EmployeeID -like '*'" | 
                  Where-Object { $blockedUserIds -contains $_.EmployeeID })

# you can also use the '-LDAPFilter' parameter
# $usersToBlock = @(Get-ADUser -Properties EmployeeID, Name, UserPrincipalName  -LDAPFilter "(employeeID=*)" | 
#                   Where-Object { $blockedUserIds -contains $_.EmployeeID })

# you now should have an array of user objects that need to be blocked
if ($usersToBlock.Count) {
    Write-Host "Blocking $($usersToBlock.Count) users.." -ForegroundColor Green
    $usersToBlock | ForEach-Object {
        Write-Host "Blocking user $($_.Name)"
        Set-MsolUser -UserPrincipalName $($_.UserPrincipleName) -BlockCredential $true
    }
}
else {
    Write-Warning "No users found with an EmployeeId property that matches any of the values in BlockedUsers.csv"
}