Objective 

This article guides you through the process of removing the ADSelfService_Enroll.hta logon script from all users in your AD environment. This is necessary when the script was inadvertently applied to all users instead of a specific OU or group via ADSelfService Plus policy configuration.

Prerequisites 

• Administrator access to the primary domain controller and the ADSelfService Plus console.

• PowerShell should be installed on the domain controller.

• Active Directory module for PowerShell should be installed.

Steps to follow 

Step 1: Modify the ADSelfService Plus policy configuration

1. Log in to the ADSelfService Plus administrative console.

2. Navigate to Configuration > Self-Service > Policy Configuration.

3. Locate and edit the policy that applied the logon script.

4. Modify the policy to select only the intended OUs or groups.

5. Save the changes.

 Step 2: Remove the logon script via PowerShell

1. Open PowerShell as an administrator on your domain controller.

2. Import the Active Directory module using the command import-module activedirectory

3. Execute the following command to remove the ADSelfService_Enroll.hta script from all user accounts
   

get-aduser -filter {scriptPath -like 'ADSelfService_Enroll.hta'} | Set-ADUser -Clear scriptPath 

This command finds all users with the specified script path and clears the script path attribute.

Validation and confirmation 

1. Log in to a domain computer as a user who is not included in the ADSelfService Plus policy configuration.
   
2. Verify that the force enrollment pop-up does not appear during login.
   

Best practices 

1. When configuring ADSelfService Plus policies, always select specific OUs or groups to avoid applying settings to unintended users.
   
2. ​Test policy changes in a test environment before implementing them in production.
   
3. ​Regularly review the logon scripts assigned to users to ensure they are still necessary.
   

How to reach support