Script to Delete User Profiles from Stolen Computer

#To define a particular parameter, replace the 'parameterName' inside itsm.getParameter('parameterName') with that parameter's name

import subprocess as sp

from shutil import rmtree

import os 

import ctypes

from subprocess import PIPE, Popen

​

gt=[]

​

try:

    wdir=os.environ['PROGRAMDATA']+'\\temp'

    if not os.path.exists(wdir):

            os.mkdir(wdir)

except:

    wdir=os.environ['SYSTEMDRIVE']

​

fp=wdir+'\\users.txt'

cmd="wmic useraccount get name"

obj=sp.Popen(cmd, shell=True, stdout = sp.PIPE, stderr = sp.PIPE)

out, err = obj.communicate()

​

with open(fp, 'w+') as dr:

    dr.write(out)

​

with open(fp, 'r+') as dr:

    for i in dr: None if 'Name' in i or 'DefaultAccount' in i or 'Guest' in i or 'Administrator' in i else gt.append(i.strip())

​

print gt

class disable_file_system_redirection:

    _disable = ctypes.windll.kernel32.Wow64DisableWow64FsRedirection

    _revert = ctypes.windll.kernel32.Wow64RevertWow64FsRedirection

    def __enter__(self):

        self.old_value = ctypes.c_long()

        self.success = self._disable(ctypes.byref(self.old_value))

    def __exit__(self, type, value, traceback):

        if self.success:

            self._revert(self.old_value)

with disable_file_system_redirection():

    for accountname in gt:

        cmd="net user "+accountname+" /delete"

        print os.popen(cmd).read()

        try:

            path="C:\\Users\\"+accountname

            obj=sp.Popen("rmdir /Q/S "+path,stdin=sp.PIPE,stdout=sp.PIPE,shell=True)

            print(obj.communicate()[0])

            obj3=sp.Popen("hostname",stdin=sp.PIPE,stdout=sp.PIPE)

            computername=obj3.communicate()[0].strip()

            obj2=sp.Popen("Get-CimInstance -ComputerName" +computername+"  -Class Win32_UserProfile | Where-Object { $_.LocalPath.split('\')[-1] -eq "+accountname+" } | Remove-CimInstance")

            print obj2.communicate()[0]

            print "Done"

        except:

            pass

​