Script repository

# Get home directory path.
try
{
    $homeDirectoryPath = $Context.TargetObject.Get("homeDirectory")
}
catch
{
    $Context.LogMessage("The user doesn't have a home directory", "Warning")
    return
}

# Bind to the 'Configuration Set Settings' container.
$configSetSettingsPath = $Context.GetWellKnownContainerPath("ConfigurationSetSettings")
$configSetSettings = $Context.BindToObject($configSetSettingsPath)

# Get SIDs of all service administrators.
$adminManager = $configSetSettings.AdministratorManager
$adminsSidsBytes = $adminManager.Administrators
$adminSids = New-Object "System.Collections.Generic.HashSet[System.String]"
foreach ($sidBytes in $adminsSidsBytes)
{
    $sid = New-Object "Softerra.Adaxes.Adsi.Sid" @($sidBytes, 0)
    [void]$adminSids.Add($sid)
}

# Get home directory ACL.
$acl = Get-Acl -Path $homeDirectoryPath

# Find and remove the Adaxes service account from the ACL.
$accessRules = $acl.Access
for ($i = $accessRules.Count - 1; $i -ge 0; $i--)
{
    $accessRule = $accessRules[$i]
    $isInherited = $accessRule.IsInherited
    foreach ($identityReference in $accessRule.IdentityReference)
    {
        # Translate identity to SID.
        $sid = $identityReference.Translate("System.Security.Principal.SecurityIdentifier").Value
        if (!($adminSids.Contains($sid)))
        {
            continue
        }
        
        # Check if permission are inherited from a parent container.
        $userIdentity = $identityReference.Value
        $userPermissions = $identityReference
        if ($isInherited)
        {
            $Context.LogMessage("Cannot remove permissions '$userPermissions' for '$userIdentity' because access rights are inherited from a parent container", "Warning")
            continue
        }
        
        [void]$acl.RemoveAccessRule($accessRule)
    }
}

# Assign modified ACL.
$folder = Get-Item $homeDirectoryPath
$folder.SetAccessControl($acl)