Problem overview
This script tackles the issue of lingering or unauthorized local user accounts on Windows machines by providing a simple, automated way to disable or delete them, ultimately tightening security and preventing accidental or intentional misuse of overlooked user profiles.
<#
This resource is provided as a convenience for Level users. We cannot
guarantee it will work in all environments. Please test before deploying
to your production environment. We welcome contributions to our community
library
Level Library
https://level.io/library/script-windows-delete-disable-users
#>
# Split the string into an array
$userArray = "{{UsersToDelete}}" -split ',' | ForEach-Object { $_.Trim() }
foreach ($user in $userArray) {
# Check if the user exists (assuming we're looking for local users by username)
if (Get-LocalUser -Name $user -ErrorAction SilentlyContinue) {
try {
# Disable the user account
Disable-LocalUser -Name $user
Write-Output "User $user has been disabled."
# Commented out: To delete instead of disable, uncomment the next line
# Remove-LocalUser -Name $user
# Write-Output "User $user has been deleted."
}
catch {
# Use double quotes with escaping for the colon
Write-Error "Failed to disable user $user`: $_"
}
} else {
Write-Output "User $user does not exist."
}
}
It uses a string of comma-separated usernames supplied through a Level script variable, converting them into an array for sequential processing. For each user, the script checks whether the account exists, then disables it by default to prevent login attempts. A simple uncommented line can switch the behavior from disabling to permanently removing the user account, granting administrators a flexible way to handle unauthorized or unneeded users. By running under System-level permissions, it ensures minimal manual intervention and reduces friction in day-to-day security operations.
Use cases
- Promptly disabling unauthorized or forgotten user accounts on Windows
- Automating the cleanup of unused or stale profiles for better security hygiene
- Responding to real-time alerts from a script-based monitor in Level
- Enforcing account-based compliance within a broader admin compliance automation
Recommendations
- Pair this script with a script-based monitor in Level to take immediate action when unauthorized users are detected
- For routine cleanups, schedule it through a Level automation to run automatically at desired intervals
- Test the script on a non-production environment before rolling out to ensure correct behavior
- Keep your “UsersToDelete” variable list accurate and current for best results
- Check out the Admin Compliance & Remediation Automation