Windows Lock Device Script

<#
This resource is provided as a convenience for Level users. We cannot 
guarantee it will work in all environments. Please test before deploying 
to your production environment. We welcome contributions to our community 
library

Level Library
https://level.io/library/script-windows-lock-device
#>

# We use a script-scoped variable so that all functions can modify it.
# Initialize $script:errors to $false at the start.
$script:errors = $false

# Function to check if the device is domain-joined
function Is-DomainJoined {
    $domain = (Get-WmiObject Win32_ComputerSystem).PartOfDomain
    return $domain
}

# Function to log out all users
function LogOut-Users {
    try {
        $sessions = query session 2>$null | ForEach-Object {
            $fields = $_ -split '\s{2,}'
            if ($fields.Count -ge 3) {
                [PSCustomObject]@{
                    SessionName = $fields[0]
                    UserName = $fields[1]
                    SessionID = $fields[2]
                }
            }
        }

        foreach ($session in $sessions) {
            if ($session.UserName -and $session.SessionID -match '^\d+$') {
                try {
                    logoff $session.SessionID
                    Write-Host "User $($session.UserName) has been logged out."
                } catch {
                    Write-Host "ALERT: Failed to log out user $($session.UserName): $_"
                    $script:errors = $true
                }
            }
        }
    } catch {
        Write-Host "ALERT: Error retrieving user sessions: $_"
        $script:errors = $true
    }
}

# Function to disable all local accounts
function Disable-LocalAccounts {
    try {
        $localUsers = Get-LocalUser
        foreach ($user in $localUsers) {
            try {
                Disable-LocalUser -Name $user.Name
                Write-Host "Local account $($user.Name) has been locked."
            } catch {
                Write-Host "ALERT: Failed to lock local account $($user.Name): $_"
                $script:errors = $true
            }
        }
    } catch {
        Write-Host "ALERT: Error retrieving local accounts: $_"
        $script:errors = $true
    }
}

# Function to disable Active Directory accounts (only if domain-joined)
function Disable-ADAccounts {
    try {
        $adUsers = Get-WmiObject Win32_ComputerSystem | Select-Object -ExpandProperty UserName
        if ($adUsers -and $adUsers -match '\\') {
            foreach ($adUser in $adUsers) {
                try {
                    # Extract just the username (DOMAIN\Username format)
                    $adUserName = $adUser -split '\\' | Select-Object -Last 1
                    Disable-ADAccount -Identity $adUserName -Confirm:$false
                    Write-Host "AD account $adUserName has been locked."
                } catch {
                    Write-Host "ALERT: Failed to lock AD account $($adUserName): $($_.Exception.Message)"
                    $script:errors = $true
                }
            }
        }
    } catch {
        Write-Host "ALERT: Failed to retrieve AD users: $_"
        $script:errors = $true
    }
}

# Execute actions
LogOut-Users
Disable-LocalAccounts

# If the system is domain-joined, disable AD users
if (Is-DomainJoined) {
    Write-Host "Domain detected. Locking AD users..."
    Disable-ADAccounts
} else {
    Write-Host "No domain detected. Skipping AD account lock."
}

if ($script:errors) {
    Write-Host "ALERT: Errors occurred during execution. Exiting with code 1."
    exit 1
}

Write-Host "All users have been logged out and locked successfully."