Public/Remove-PWSHPUKMGT-UserDevice.ps1
|
<# .SYNOPSIS Removes the user/device/PUK record for a user. .DESCRIPTION Resolves the given identity in Active Directory and removes its PWSHPUKMGT record from the configured hosting backend (flat file or Active Directory). Throws if no record exists. This cmdlet requires confirmation by default (ConfirmImpact = High); pass -Confirm:$false to suppress the prompt in unattended/automation scenarios. .PARAMETER Identity A SamAccountName, UserPrincipalName, or DistinguishedName identifying the user. Accepts pipeline input, including AD user objects. .PARAMETER Server The domain controller to run the underlying LDAP requests against. Defaults to the value configured in hosting.activeDirectory.server, or, if that is not set either, to the primary domain controller (PDC emulator) of the current domain. .EXAMPLE Remove-PWSHPUKMGT-UserDevice -Identity 'alice' #> function Remove-PWSHPUKMGT-UserDevice { [CmdletBinding(SupportsShouldProcess, ConfirmImpact = 'High')] param( [Parameter(Mandatory, Position = 0, ValueFromPipeline, ValueFromPipelineByPropertyName)] [Alias('SamAccountName', 'UserPrincipalName', 'DistinguishedName')] [string]$Identity, [string]$Server ) begin { $config = Get-PukModuleConfig $certificate = if ($config.hosting.model -eq 'FlatFile') { Test-PukCertificate -Thumbprint $config.certificate.thumbprint -StoreLocation $config.certificate.storeLocation -RequiredEkuOids $config.certificate.requiredEkuOids } else { $null } $effectiveServer = Resolve-PukServer -Server $Server -Config $config } process { $distinguishedName = Resolve-PukIdentity -Identity $Identity -Server $effectiveServer if (-not $PSCmdlet.ShouldProcess($distinguishedName, 'Remove PWSHPUKMGT user/device/PUK record')) { return } Remove-PukRecord -Config $config -Certificate $certificate -DistinguishedName $distinguishedName -Server $effectiveServer -Confirm:$false Write-PukLog -Level Info -Config $config -Message "Remove-PWSHPUKMGT-UserDevice: removed record for '$distinguishedName'." } } |