Disable-CsUser

Syntax

Disable-CsUser
       [-Identity] <UserIdParameter>
       [-DomainController <Fqdn>]
       [-PassThru]
       [-Confirm]
       [-WhatIf]
       [<CommonParameters>]

Description

The Disable-CsUser cmdlet deletes all the attribute information related to Skype for Business Server from an Active Directory user account; this prevents the user from logging on to Skype for Business Server.

When you run the Disable-CsUser cmdlet all the Skype for Business Server-related attributes are removed from an account, including the Identities of any per-user policies that have been assigned to that account. You can later re-enable the account by using the Enable-CsUser cmdlet. However, all the Skype for Business Server-related information (such as policy assignments) previously associated with that account will have to be re-created.

If you want to prevent a user from logging on to Skype for Business Server, but do not want to lose all of their account information, use the Set-CsUser cmdlet instead. For details, see the Set-CsUser cmdlet help topic.

After an account has been disabled with the Disable-CsUser cmdlet, the affected user will no longer be returned by the Get-CsUser cmdlet; that's because that user no longer has a valid Skype for Business Server account. To retrieve information for the disabled user account, use the Get-CsAdUser cmdlet.

In addition, user data belonging to the deleted user account will be removed from the backend databases; for example, the user will be removed from Contacts lists in the organization, and any conferences scheduled by that user will be deleted.

By default, members of the following groups are authorized to run the Disable-CsUser cmdlet locally: RTCUniversalUserAdmins. To return a list of all the role-based access control (RBAC) roles this cmdlet has been assigned to (including any custom RBAC roles you have created yourself), run the following command from the Windows PowerShell prompt:

Get-CsAdminRole | Where-Object {$_.Cmdlets -match "Disable-CsUser"}

Examples

-------------------------- Example 1 --------------------------

Disable-CsUser -Identity "Ken Myer"

Example 1 disables the Skype for Business Server account for the user Ken Myer. In this example, the user's display name is used to indicate his Identity.

-------------------------- Example 2 --------------------------

Get-CsUser -LdapFilter "Department=Finance" | Disable-CsUser

In Example 2, all the users in the Finance department have their Skype for Business Server 2015 accounts disabled. To carry out this task, the command first uses the Get-CsUser cmdlet and the LdapFilter parameter to return a collection of all the users who belong to the Finance department. That collection is then piped to the Disable-CsUser cmdlet, which disables each account in the collection.

-------------------------- Example 3 --------------------------

Get-CsUser -UnassignedUser | Disable-CsUser

In this example, all the user accounts not currently assigned to a Registrar pool are disabled. To do this, the Get-CsUser cmdlet is called, along with the UnassignedUser parameter. This parameter restricts the returned data to users who have valid user accounts but are not assigned to a Registrar pool. That collection is then piped to the Disable-CsUser cmdlet, which disables each account in the collection.

Parameters

-Confirm

-DomainController

-Identity

-PassThru

-WhatIf

Inputs

String or Microsoft.Rtc.Management.ADConnect.Schema.ADUser

The Disable-CsUser cmdlet accepts a pipelined string value representing the Identity of a user account that has been enabled for Skype for Business Server. The cmdlet also accepts pipelined instances of the Active Directory user object.

Outputs

None

The Disable-CsUser cmdlet does not return a value or object. Instead, the cmdlet configures instances of the Microsoft.Rtc.Management.ADConnect.Schema.ADUser object.

Related Links

• Enable-CsUser
• Get-CsUser