2.6 KiB
Table of Contents
Overview
Process
Script
Exceptions
Logging
Overview
This document defines the process in which CBP has implemented automated processing to address the NIST Security control AC-2(3), for inactivity as it pertains to Microsoft Active Directory computer accounts.
AC-2(3) Defined:
Access Control procedures or other documentation that document the automatic disabling of inactive accounts after organization defined time period. A CBP custom script process performs this function for computer accounts in AD.
CBP has defined that inactive STANDARD computer accounts as:
Disabled after forty five (45) days of inactivity
Deleted after sixty (60) days of inactivity
Process
A scheduled task is executed by automation using Orchestrator daily, view/configure using RunBook Designer:
Runbook Location: EDMED\Runbooks\Job Runbooks\EDMED\WSG\Active Directory\User Tasks\ Clean User Objects V2
Script: D:\Data\Scripts\UserTasks\CleanUserObjects\ADUserCleanV2.1.ps1
Command line argument: RUN (if no argument supplied runs in 'whatif' mode)
Log location: Logs to subdirectory of the main script \Log\
This script is used to automate disable/delete user objects based on the last time they logged into AD, specifically the lastlogintimestamp attribute. The script can be run in 'whatif' mode (making no changes) unless you supply RUN as a command line argument. When you run with argument RUN the script will make changes. Examples:
& '.\ADUserCleanV2.1.ps1' # without RUN (or anything other than RUN) makes no changes, logs to screen and log file
& '.\ADUserCleanV2.1.ps1' RUN # with RUN command argument it will make changes in AD if you have AD permission to do so!
The script checks each users's lastlogintimestamp using configurable thresholds found in the beginning of the script. When a user is at the delete threshold it is deleted and when at disable threshold it is disabled.
Orchestrator Details
Account used by Orchestrator to make changes in AD and write to SQL: AD\SVC-EDME-USER-CL
Job Runbook
DETAILS
Computer: tnwg01a-v3824 (subject to change to cluster model vs. single server)
Program Path: c:\windows\system32\WindowsPowerShell\v1.0\powershell.exe
Parameters: D:\Data\Scripts\UserTasks\CleanUserObjects\ADUserCleanV2.1.ps1 RUN
ADVANCED
Run as Username (Orchestrator global settings variable): {SVC-EDME-USER-CLEAN}
Password (Orchestrator global settings variable): {SVC-EDME-USER-CLEANPWD}
Scheduled Runbooks: References the above job runbook, runs daily at 8:12 PM (schedule is not significant)