teamviewer.com link icon
or
Ask The Community

TeamViewer is one of the winners of the European Customer Centricity Award 🥳


Please find more information here.

Script for deleting obsolete computer account and revoke user account using company AD

By moving to TV 14, I had certain requirements to facilitate the administrative tasks as follow:

- Delete any TV computer that does not exist in company Active Directory or didn't report to TV Console for specified consecutive days.

- Revoke user access if the user account does not either exist or disabled.
Here is a script that I wrote to achieve the above requirements:

.SYNOPSIS
This script manages TeamViewer Online Accounts.

.DESCRIPTION
This script helps removing any inactive device which was not connected to specified number of consecutive days using parameter $DevInactiveDays
and revokes the user access if the user account is either disabled or not exists in company AD.

.PARAMETER DevInactiveDays
Number of consecutive days that a device is not connected to TV Console

.PARAMETER TVAPIKey
TeamViewer API Key used to connect to TV Management Console

.PARAMETER activateLog
Enable log

.PARAMETER logFile
Specify the log file path and name. To be used with -activeLog $True

.PARAMETER Test
Simulate without performing any change.

.PARAMETER ListOnly
List only computers and users account.

.NOTES
Author : S. S
Version : 1.0
Creation Date: 22-May-2019
#>

Param (
[Parameter(Mandatory=$true)]
[string] $TVAPIKey,
[Parameter(Mandatory=$true)][int] $DevInactiveDays,
[bool] $activateLog,
[string] $logFile,
[bool] $Test,
[Switch] $ListOnly
)

if ($activateLog -and $logFile) {Start-Transcript -Path $logFile -Force -Append}

$bearer = "Bearer",$TVAPIKey
$header = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
$header.Add("authorization", $bearer)
$header.Add("Content-Type","application/json")
$DelComp = $False
$RvkUsr = $False

Write-Host "User Supplied parameters"
Write-Host " Device Inactive Days: " $DevInactiveDays
Write-Host " Activate Log: " $activateLog
Write-Host " Test mode: " $Test
Write-Host " Log file name: " $logFile
Write-Host

# Collecting computers from TV Mgmt Console
try {
Write-Host "Please standby while enumering all registered TV machines..."
$machines = Invoke-RestMethod -Uri "https://webapi.teamviewer.com/api/v1/devices" -Method Get -Headers $header -ErrorAction SilentlyContinue -ErrorVariable oErr
}
catch {
Write-Host "Error encountered while enumering devices: "
$_.Exception
}

if (!$oErr) {
$devArr = @()

ForEach($dev in $machines.devices)
{
try {
$devADAcc = Get-ADComputer -Filter ('Name -eq "{0}"' -f $dev.alias) -Properties Enabled | Select-Object Enabled

if (!$devADAcc) {$devADAcc = New-Object PSObject -Property @{'Enabled' = "NA"}}
}

catch {
$_.Exception
if ($activateLog -and $logFile) {Stop-Transcript}
Exit 1
}

$devArr += New-Object PSObject -Property @{
'Computer Name' = $dev.alias
'Device ID' = $dev.device_id
'AD Account Status' = $devADAcc.Enabled
'Last Seen' = $dev.last_seen
'Online State' = $dev.online_state -Join ", "
}

if ($dev.last_seen) {
$datediff = (NEW-TIMESPAN -Start $dev.last_seen -End (get-date -format yyyy-MM-ddTHH:mm:ssZ)).days
} Else {
$datediff = 0
}

if ($devADAcc.enabled -like "NA" -and $datediff -gt $DevInactiveDays -and $dev.online_state -ceq "Offline") {
$dt = Get-Date
$DelComp = $True

if (!$ListOnly) {
if ($Test) {
Write-Host "[" $dt "] Device" $dev.alias "didn't report for last" $datediff "consecutive days and could be deleted."
} else {
Write-Host "[" $dt "] Device" $dev.alias "didn't report for last" $datediff "consecutive days. So deleting it..."

# Deleting a device which is not found in AD and didn't report more than specified consecutive days.
$uri = "https://webapi.teamviewer.com/api/v1/devices/"+$dev.device_id
$retResult = Invoke-RestMethod -Uri $uri -Method Delete -Headers $header -ErrorAction Continue -ErrorVariable oErr

if ($oErr) {Write-Host " Failed to delete due " $oErr} else {Write-Host " Successfully deleted."}
}
}
}
}

if (!$DelComp -and !$ListOnly) {Write-Host " No computer account found with specified criteria to be deleted!"}

if ($ListOnly) {$devArr|FT -Property "Computer Name", "Online State", "Device ID", "AD Account Status", "Last Seen" -AutoSize}
}

# Collecting users from TV Mgmt Console
try {
Write-Host "Please standby while enumering all users account..."
$users = Invoke-RestMethod -Uri "https://webapi.teamviewer.com/api/v1/users?full_list=true" -Method Get -Headers $header -ErrorAction SilentlyContinue -ErrorVariable oErr
}
catch {
Write-Host "Error encountered while enumering users: "
$_.Exception
}

if (!$oErr) {


$usrArr = @()

ForEach($usr in $users.users)
{
try {
$usrADAcc = Get-ADUser -Filter ('EmailAddress -eq "{0}"' -f $usr.email) -Properties Enabled | Select-Object Enabled

if (!$usrADAcc) {$usrADAcc = New-Object PSObject -Property @{'Enabled' = $False}}
}

catch {
$_.Exception
if ($activateLog -and $logFile) {Stop-Transcript}
Exit 1
}

$usrArr += New-Object PSObject -Property @{
'User ID' = $usr.id
'Name' = $usr.name
'Email' = $usr.email
'Permissions' = $usr.permissions
'AD Account Status' = $usrADAcc.Enabled
'active' = $usr.active -Join ", "
}

if ($usrADAcc.Enabled -eq $False) {
$dt = Get-Date
$RvkUsr = $True

if (!$ListOnly) {
if ($Test) {
Write-Host "[" $dt "] User" $usr.name "active directory account is disabled and can be revoked."
} else {
$body = @{
active = $false;
}|ConvertTo-Json

Write-Host "[" $dt "] User" $usr.name "active directory account is disabled. So revoking this user access..."

# Revoke a user account if the user AD account is disabled
$uri = "https://webapi.teamviewer.com/api/v1/users/"+$usr.id
$retResult = Invoke-RestMethod -Uri $uri -Method Put -Headers $header -Body $body -ErrorAction Continue -ErrorVariable oErr

if ($oErr) {Write-Host " Failed to revoke the account due error" $oErr} else {Write-Host " Successfully revoked."}
}
}
}
}

if (!$RvkUsr -and !$ListOnly) {Write-Host " No user account found with specified criteria to be revoked!"}
if ($ListOnly) {$usrArr|FT -Property "Name", "Email", "User ID", "Active", "AD Account Status", "Permissions" -AutoSize}
}

if ($activateLog -and $logFile) {Stop-Transcript}



The parameters TVAPIKEY and DevInactiveDays are mandatory.

You need to create an API token which should have following access:
                                     Access Level = User
                           User management = Create users, view users, edit users
                         Group management = Read groups
           Computers & Contacts = View entries, add entries, edit entries, remove entries

To list users and computers, invoke the following command:

.\PScript.ps1 -TVAPIKey your_api_key -DevInactiveDays whatever_the_number -ListOnly

To delete any computers which didn't report for the past 30 days:

.\PScript.ps1 -TVAPIKey your_api_key -DevInactiveDays 30


To evaluate without performing the change:

.\PScript.ps1 -TVAPIKey your_api_key -DevInactiveDays whatever_the_number -Test
To log, simply use -activateLog $True -logFile "file_path_name"