Posted by GWorld
Digon

Script for deleting obsolete computer account and revoke user account using company AD

By moving to TV 14, I had certain requirements to facilitate the administrative tasks as follow:

- Delete any TV computer that does not exist in company Active Directory or didn't report to TV Console for specified consecutive days.

- Revoke user access if the user account does not either exist or disabled.

Here is a script that I wrote to achieve the above requirements:

<#
.SYNOPSIS
     This script manages TeamViewer Online Accounts.
	 
.DESCRIPTION
     This script helps removing any inactive device which was not connected to specified number of consecutive days using parameter $DevInactiveDays
	 and revokes the user access if the user account is either disabled or not exists in company AD.

.PARAMETER DevInactiveDays
	 Number of consecutive days that a device is not connected to TV Console
	 
.PARAMETER TVAPIKey
	 TeamViewer API Key used to connect to TV Management Console
	 
.PARAMETER activateLog
	 Enable log

.PARAMETER logFile
	 Specify the log file path and name. To be used with -activeLog $True
	 
.PARAMETER Test
	 Simulate without performing any change.
	 
.PARAMETER ListOnly
	 List only computers and users account.
	 
.NOTES
     Author       : Sutha.S
	 Version      : 1.0
	 Creation Date: 22-May-2019
#>

Param (
	[Parameter(Mandatory=$true)]
	[string] $TVAPIKey,
	[Parameter(Mandatory=$true)][int] $DevInactiveDays,
	[bool] $activateLog,
	[string] $logFile,
	[bool] $Test,
	[Switch] $ListOnly
)

if ($activateLog -and $logFile) {Start-Transcript -Path $logFile -Force -Append}

$bearer = "Bearer",$TVAPIKey
$header = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
$header.Add("authorization", $bearer)
$header.Add("Content-Type","application/json")
$DelComp = $False
$RvkUsr = $False

Write-Host "User Supplied parameters"
Write-Host "    Device Inactive Days: " $DevInactiveDays
Write-Host "            Activate Log: " $activateLog
Write-Host "               Test mode: " $Test
Write-Host "           Log file name: " $logFile
Write-Host

# Collecting computers from TV Mgmt Console
try {
	 Write-Host "Please standby while enumering all registered TV machines..."
	 $machines = Invoke-RestMethod -Uri "https://webapi.teamviewer.com/api/v1/devices" -Method Get -Headers $header -ErrorAction SilentlyContinue -ErrorVariable oErr
}
catch {
	 Write-Host "Error encountered while enumering devices: "
	 $_.Exception
}

if (!$oErr) {
	$devArr = @()

	ForEach($dev in $machines.devices)
	{
		try {
			$devADAcc = Get-ADComputer -Filter ('Name -eq "{0}"' -f $dev.alias) -Properties Enabled | Select-Object Enabled
		
			if (!$devADAcc) {$devADAcc = New-Object PSObject -Property @{'Enabled' = "NA"}}
		}
		
		catch {
			$_.Exception
			if ($activateLog -and $logFile) {Stop-Transcript}
			Exit 1
		}
		
		$devArr += New-Object PSObject -Property @{
				'Computer Name' = $dev.alias
				'Device ID' = $dev.device_id
				'AD Account Status' = $devADAcc.Enabled
				'Last Seen' = $dev.last_seen
				'Online State' = $dev.online_state  -Join ", "
		}
		
		if ($dev.last_seen) {
			$datediff = (NEW-TIMESPAN -Start $dev.last_seen -End (get-date -format yyyy-MM-ddTHH:mm:ssZ)).days
		} Else {
			$datediff = 0
		}
		
		if ($devADAcc.enabled -like "NA" -and $datediff -gt $DevInactiveDays -and $dev.online_state -ceq "Offline") {
			$dt = Get-Date
			$DelComp = $True
			
			if (!$ListOnly) {
				if ($Test) {
					Write-Host "[" $dt "] Device" $dev.alias "didn't report for last" $datediff "consecutive days and could be deleted."
				} else {
					Write-Host "[" $dt "] Device" $dev.alias "didn't report for last" $datediff "consecutive days. So deleting it..."
					
					# Deleting a device which is not found in AD and didn't report more than specified consecutive days.
					$uri = "https://webapi.teamviewer.com/api/v1/devices/"+$dev.device_id
					$retResult = Invoke-RestMethod -Uri $uri -Method Delete -Headers $header -ErrorAction Continue -ErrorVariable oErr
					
					if ($oErr) {Write-Host "			Failed to delete due " $oErr} else {Write-Host "			Successfully deleted."}
				}
			}
		}
	}

	if (!$DelComp -and !$ListOnly) {Write-Host "   No computer account found with specified criteria to be deleted!"}
	
	if ($ListOnly) {$devArr|FT -Property "Computer Name", "Online State", "Device ID", "AD Account Status", "Last Seen" -AutoSize}
}

# Collecting users from TV Mgmt Console
try {
	 Write-Host "Please standby while enumering all users account..."
	 $users = Invoke-RestMethod -Uri "https://webapi.teamviewer.com/api/v1/users?full_list=true" -Method Get -Headers $header -ErrorAction SilentlyContinue -ErrorVariable oErr
}
catch {
	 Write-Host "Error encountered while enumering users: "
	 $_.Exception
}

if (!$oErr) {
	 

	$usrArr = @()

	ForEach($usr in $users.users)
	{
		try {
			$usrADAcc = Get-ADUser -Filter ('EmailAddress -eq "{0}"' -f $usr.email) -Properties Enabled | Select-Object Enabled
		
			if (!$usrADAcc) {$usrADAcc = New-Object PSObject -Property @{'Enabled' = $False}}
		}
		
		catch {
			$_.Exception
			if ($activateLog -and $logFile) {Stop-Transcript}
			Exit 1
		}
		
		$usrArr += New-Object PSObject -Property @{
				'User ID' = $usr.id
				'Name' = $usr.name
				'Email' = $usr.email
				'Permissions' = $usr.permissions
				'AD Account Status' = $usrADAcc.Enabled
				'active' = $usr.active -Join ", "
		}

		if ($usrADAcc.Enabled -eq $False) {
			$dt = Get-Date		
			$RvkUsr = $True
			
			if (!$ListOnly) {
				if ($Test) {
					Write-Host "[" $dt "] User" $usr.name "active directory account is disabled and can be revoked."
				} else {
					$body = @{
						active = $false;
					}|ConvertTo-Json
					
					Write-Host "[" $dt "] User" $usr.name "active directory account is disabled. So revoking this user access..."
					
					# Revoke a user account if the user AD account is disabled
					$uri = "https://webapi.teamviewer.com/api/v1/users/"+$usr.id
					$retResult = Invoke-RestMethod -Uri $uri -Method Put -Headers $header -Body $body -ErrorAction Continue -ErrorVariable oErr

					if ($oErr) {Write-Host "			Failed to revoke the account due error" $oErr} else {Write-Host "			Successfully revoked."}
				}
			}
		}	
	}

	if (!$RvkUsr -and !$ListOnly) {Write-Host "   No user account found with specified criteria to be revoked!"}
	if ($ListOnly) {$usrArr|FT -Property "Name", "Email", "User ID", "Active", "AD Account Status", "Permissions" -AutoSize}
}

if ($activateLog -and $logFile) {Stop-Transcript}

The parameters TVAPIKEY and DevInactiveDays are mandatory.

You need to create an API token which should have following access:

     Access Level = User
    User management = Create users, view users, edit users
    Group management = Read groups
   Computers & Contacts = View entries, add entries, edit entries, remove entries

To list users and computers, invoke the following command:

.\PScript.ps1 -TVAPIKey your_api_key -DevInactiveDays whatever_the_number -ListOnly

To delete any computers which didn't report for the past 30 days:

.\PScript.ps1 -TVAPIKey your_api_key -DevInactiveDays 30

To evaluate without applying the change:

.\PScript.ps1 -TVAPIKey your_api_key -DevInactiveDays whatever_the_number -Test

Enable logging by by activating switches:

-activateLog $True -logFile "file_path_name"

Hope this post is helpful!