Add script to automate account deletion

deployment/administration/Delete_Unassigned_Users.ps1

@@ -0,0 +1,28 @@
+# Extract list of users
+$userOuPath = (Get-ADObject -Filter * | Where-Object { $_.Name -eq "Safe Haven Research Users" }).DistinguishedName
+$users = Get-ADUser -Filter * -SearchBase "$userOuPath" -Properties *
+foreach ($user in $users) {
+    $groupName = ($user | Select-Object -ExpandProperty MemberOf | ForEach-Object { (($_ -Split ",")[0] -Split "=")[1] }) -join "|"
+    $user | Add-Member -NotePropertyName GroupName -NotePropertyValue $groupName -Force
+}
+
+# Delete users not found in any group
+foreach ($user in $users) {
+    if (!($user.GroupName)) {
+        $name = $user.SamAccountName
+        Remove-ADUser -Identity $name
+    }
+}
+
+# Force sync with AzureAD. It will still take around 5 minutes for changes to propagate
+Write-Output "Synchronising locally Active Directory with Azure"
+try {
+    Import-Module -Name "C:\Program Files\Microsoft Azure AD Sync\Bin\ADSync" -ErrorAction Stop
+    Start-ADSyncSyncCycle -PolicyType Delta
+}
+catch [System.IO.FileNotFoundException] {
+    Write-Output "Skipping as Azure AD Sync is not installed"
+}
+catch {
+    Write-Output "Unable to run Azure Active Directory synchronisation!"
+}

deployment/administration/SRE_Delete_Unassigned_Users.ps1

@@ -0,0 +1,25 @@
+param(
+    [Parameter(Mandatory = $true, HelpMessage = "Enter SHM ID (e.g. use 'testa' for Turing Development Safe Haven A)")]
+    [string]$shmId
+)
+
+Import-Module Az.Accounts -ErrorAction Stop
+Import-Module $PSScriptRoot/../common/AzureCompute -Force -ErrorAction Stop
+Import-Module $PSScriptRoot/../common/Configuration -Force -ErrorAction Stop
+Import-Module $PSScriptRoot/../common/Logging -Force -ErrorAction Stop
+
+# Get config
+# -------------------------------
+$config = Get-ShmConfig -shmId $shmId
+$originalContext = Get-AzContext
+
+# Delete users not currently in a security group
+# ----------------------------------------------
+$null = Set-AzContext -SubscriptionId $config.subscriptionName -ErrorAction Stop
+Add-LogMessage -Level Info "Deleting users not assigned to any security group: $($config.shm.id) from $($config.dc.vmName)..."
+
+$script = "Delete_Unassigned_Users.ps1"
+
+$result = Invoke-RemoteScript -Shell "PowerShell" -ScriptPath $script -VMName $config.dc.vmName -ResourceGroupName $config.dc.rg
+
+$null = Set-AzContext -Context $originalContext -ErrorAction Stop