Warning Before Disabling a User in Lync Server

How come there isn't a warning prompt that appears when you run Disable-CsUser? It seems like a kind of dangerous cmdlet to not have a warning.

We hate to sound like a broken record, at least in part because we aren't sure that there are any people out there who even remember what records were. However, the answer to this question is one we've used to answer other questions: because that's the way the Disable-CsUser cmdlet was designed. When you create a Windows PowerShell cmdlet, one of the properties you can set is ConfirmImpact; this property determines whether or not a cmdlet will prompt you any time you call that cmdlet.

So what else helps determine whether or not a cmdlet will prompt you any time you call that cmdlet? Your Windows PowerShell confirmation preference. By default, the Windows PowerShell ConfirmPreference variable is set to High; you can verify that simply by asking PowerShell:

$ConfirmPreference

Got that? Good. Now, as near as we can tell, the Disable-CsUser cmdlet has a ConfirmImpact of Medium. If your ConfirmPreference is set to High, you'll only get an automatic confirmation on cmdlets where the ConfirmImpact property is also set to High; that means that no confirmation is given for cmdlets where ConfirmImpact is equal to Medium or Low. See? A ConfirmPreference of High means you only get the confirmation prompt for cmdlets where ConfirmImpact is also High. If you set ConfirmPreference to Medium then you'll be prompted if a cmdlet has a ConfirmImpact of either Medium or High.

So what can you do about that? Well, as we implied above, one thing that you can do is set your ConfirmPreference to Medium:

$ConfirmPreference = "Medium"

We tried that out and that does the trick: you'll definitely get a confirmation notice when you try to disable a user:

Confirm

Are you sure you want to perform this action?

Performing operation "Disable-CsUser" on Target "cn=kenmyer,OU=Redmond,dc=litwareinc,dc=com".

[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "Y")

On the other hand, you'll also get confirmation notices for commands that typically don't require you to confirm your actions. For example, by default the Stop-Process cmdlet will shut down a program without asking if you really want to shut down that program:

Stop-Process –Name "notepad"

If you set your ConfirmPreference to Medium, however, you will be asked to confirm that you want to shut down the process. Whether that's good or bad is up to you to decide.

Alternatively, you could train yourself to use the Confirm parameter that accompanies the Disable-CsUser cmdlet:

Disable-CsUser –Identity "Ken Myer" –Confirm

What will that do? This:

Confirm

Are you sure you want to perform this action?

Performing operation "Disable-CsUser" on Target "cn=kenmyer,OU=Redmond,dc=litwareinc,dc=com".

[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "Y")

And yes, you do have to remember to include the Confirm parameter. So here's another option: create a function that calls Disable-CsUser and the Confirm parameter. Here's a function we named Delete-CsUser:

Function Delete-CsUser {Disable-CsUser –Identity $args[0] –Confirm}

The next time you want to disable a user account use this command:

Delete-CsUser "Ken Myer"

Do that, and you'll be prompted before the account is actually disabled:

Confirm

Are you sure you want to perform this action?

Performing operation "Disable-CsUser" on Target "cn=kenmyer,OU=Redmond,dc=litwareinc,dc=com".

[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "Y")

Keep in mind that this function only works if you're trying to disable a single user account; it's going to blow up if you try to pipe it a bunch of user accounts to it:

Get-CsUser –LdapFilter "Department=Finance" | Delete-CsUser

But that should be OK. After all, if you were planning on disabling several hundred user accounts we're guessing you don’t want to respond to several hundred confirmation prompts anyway.

Note. Oh, and one other thing to keep in mind: this function will disappear the minute you close your Windows PowerShell session. Because of that, you might want to add the function to your PowerShell profile. For more information, see the article titled, well, Windows PowerShell Profiles.