Exclude disabled users from Active Directory Sync?

[evan2]

I’m successfully using the directory sync feature to enroll my users in Duo. The problem I have is that there are disabled user accounts in the groups I’m syncing, and Duo is importing them and placing them in “inactive” status. This wouldn’t be a problem except that those users use up a license. How can I exclude the disabled users so they are not imported at all?

[mkorovesisduo]

Hi evan, you will have to remove them from the directory or base DN being synced in order to prevent them from being added to Duo. When you remove users from all groups you’ve synced to Duo in the source directory, the next scheduled sync places those users into the Trash for deletion in seven days.

[ButlerKD]

Evan,

Here is some PowerShell code we use to perform the aforementioned functions. Our terminated user objects are moved to a specific OU, and then the following code is run against that target. We have it set to run multiple times per day as a scheduled task.

Hope this helps.

#########################################################
# PowerShell - Remove all users from defined group(s)	#
#	                                                #
# By - Kevin D. Butler - 02 January 2019                #
#########################################################
#
# Notes:
#
# Removes specified AD security group memebership from all user accounts defined in the "Get-ADUser -Searchbase" targeted OU and subordinate OU's if present
#
import-module activedirectory
Get-ADUser -SearchBase "OU=Terminated Employees,DC=your,DC=org" -Filter * | ForEach-Object {Remove-ADGroupMember -Identity "DuoUserGroup1" -Members $_ -Confirm:$false }
Get-ADUser -SearchBase "OU=Terminated Employees,DC=your,DC=org" -Filter * | ForEach-Object {Remove-ADGroupMember -Identity "DuoUserGroup2" -Members $_ -Confirm:$false }
Get-ADUser -SearchBase "OU=Terminated Employees,DC=your,DC=org" -Filter * | ForEach-Object {Remove-ADGroupMember -Identity "DuoUserGroup2" -Members $_ -Confirm:$false }
#
#################
# End Of Script #
#################