Lokale Benutzer in Windows im Stapel löschen

function Remove-LocalUserProfiles {
    [cmdletbinding(SupportsShouldProcess=$true)]
    param(
        [parameter(mandatory=$false)][string[]]$exclude,
        [parameter(mandatory=$true)][datetime]$olderthan
    )

    if(!(new-object System.Security.Principal.WindowsPrincipal([System.Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole(544)){
        write-error "CMDLet needs to be run with elevated permission!" -Category PermissionDenied  
        return
    }
    # adjust privilege token (add BackupPrivilege tokens)
    Add-Type –MemberDefinition '[DllImport("ntdll.dll")] public static extern int RtlAdjustPrivilege(int Privilege, bool Enable, bool CurrentThread, ref bool EnabledOut);' -name token -namespace privilege | out-null  
    9,17,18 | %{[privilege.token]::RtlAdjustPrivilege($_,1,0,[ref]0) | out-null}

    # eumerate local non special user profiles older than date and not in exclude list
    foreach($userprofile in Get-CimInstance win32_Userprofile | ?{!$_.Special -and !$_.Loaded -and $_.LastUseTime -lt $olderthan -and (New-Object System.Security.Principal.SecurityIdentifier([string]$_.Sid)).Translate([System.Security.Principal.NTAccount]).Value.split('\')[-1] -notin $exclude}){  
        # if action should take place
        if($PSCmdlet.ShouldProcess($userprofile.SID,"Remove profile and data")){  
            # remove user profile
            $userprofile | Remove-CimInstance
            # remove profile data folder
            remove-item $userprofile.LocalPath -Recurse -force
        }
    }
}

Remove-LocalUserProfiles -olderthan (get-date).AddDays(-30) -exclude "Administrator"  

function Remove-LocalUserProfiles {
    [cmdletbinding(SupportsShouldProcess=$true,ConfirmImpact="High")]  
    param(
        [Parameter(mandatory=$true)][hashtable]$GroupSettings
    )
    begin {
        if(!(new-object System.Security.Principal.WindowsPrincipal([System.Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole(544)){
            write-error "CMDLet needs to be run with elevated permission!" -Category PermissionDenied  
            break
        }
        # adjust privilege token (add BackupPrivilege tokens)
        Add-Type –MemberDefinition '[DllImport("ntdll.dll")] public static extern int RtlAdjustPrivilege(int Privilege, bool Enable, bool CurrentThread, ref bool EnabledOut);' -name token -namespace privilege | out-null  
        9,17,18 | %{[privilege.token]::RtlAdjustPrivilege($_,1,0,[ref]0) | out-null}
        # create ad searcher object
        $searcher = [adsisearcher]''  
        # specify properties to load
        [void]$searcher.PropertiesToLoad.AddRange(@('cn','memberOf','primaryGroupID'))  
        # get userprofiles without special ones
        $userprofiles = Get-CimInstance win32_Userprofile | ?{!$_.Special -and !$_.Loaded}
    }
    process{
        foreach ($profile in $userprofiles){
            # set adsisearcher filter
            $searcher.Filter = "(&(objectCategory=User)(objectSid=$($profile.SID)))"  
            # get ad user object
            $aduser = $searcher.FindOne()
            # if no ad user found skip profile
            if (!$aduser){continue}
            # check group membership
            $grp = $GroupSettings.GetEnumerator() | ?{$_.Key -in $aduser.Properties['memberOf'] -or [System.Security.Principal.SecurityIdentifier]::new(([adsi]"LDAP://$($_.Key)").objectSID[0],0).Value.split('-')[-1] -eq $aduser.Properties['primaryGroupID'][0]} | select -F 1  
            if (!$grp){continue}
            if ($profile.LastUseTime -lt (get-date).AddDays($grp.Value.Days)){
                if ($PSCmdlet.ShouldProcess($aduser.Properties['cn'],"Remove user profile")){  
                    Write-Verbose "Removing profile for SID '$($_.SID)'"  
                    # remove userprofile
                    $profile | Remove-CimInstance
                    if (Test-Path $profile.LocalPath){
                        # remove profile path
                        remove-item $profile.LocalPath -Recurse -Force
                    }
                }
            }
        }

    }
    end{}
}

Remove-LocalUserProfiles -GroupSettings @{'CN=Domänen-Benutzer,CN=Users,DC=domain,DC=de' = @{Days = -30}}