We are starting to see a large number of stale devices in our organization. I found a script online that exports all stale devices to a CSV, then the next script uses this list to remove them. Everything works fine, but the final script errors our
on each entry stating the following error:
Active Directory operation failed on (our E-mail Server). This error is not retriable. Additional information: Access
is denied.
Active directory response: 00000005: SecErr: DSID-03152487, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0
+ CategoryInfo : InvalidOperation: (The stale device) [Remove-ActiveSy
ncDevice], ADOperationException
+ FullyQualifiedErrorId : 8BE6740C,Microsoft.Exchange.Management.Tasks.RemoveMobileDevice
Clearly its stating it doesn't have the proper permissions, but I'm running this under the Domain Admin account which should have the rights to do everything. I don't know where to being with this.
Here are the scripts that we are running on this server:
$csvRows=@()
“==============================================================”
“Start Mailbox Retrieve”
“==============================================================”
$mbx = get-casmailbox -resultsize unlimited | where {$_.activesyncenabled -eq $true} ;
“==============================================================”
“End Mailbox Retrieve”
“==============================================================”
$mbx | foreach {
“Processing: “+$_.name
$name = $_.name;
$device = get-activesyncdevicestatistics -mailbox $_.identity | where {$_.LastSuccessSync -le (Get-Date).AddDays("-30")};
if($device){
foreach($dev in $device){
” Device: “+$dev.DeviceType
$csvRows += $dev
}
}
}
“==============================================================”
“Start CSV Write”
“==============================================================”
$csvRows | Export-Csv “c:\reports\staledevices.csv” -NoType
“==============================================================”
“End CSV Write”
“==============================================================”
And the second:
import-Csv .\staledevices.csv |foreach {remove-activesyncdevice -identity $_.guid -confirm:$false}