CUCM Device Manager Powershell executable for removing user devices in Cisco Unified Call Manager (CUCM) from stale/disabled users, doing so will remove the License they are holding within CUCM. Utilizes native Rest API calls to the CUCM server and only requires to be run on a system that has the Powershell Active Directory Module installed with no other dependancies. Since we are querying AD for user account information, you will want to run this tool from an account that has at least 'Read' access to the majority of OUs and Objects in your Active Directory Domain.
Now with more UI!
No install required, simply download the 'CUCM Device Manager.exe' for the executable or 'CUCM-Device-Manager-GUI.ps1' and run either on a machine with the Active Directory Powershell module installed. The function of both are identical, the exe is just packaged for convenience.
Most of the operation is self explanatory, but here is a run down of the steps to remove a device from a user:
- Verify the local CUCM server FQDN is correct for your environment (shown above). Upon logging in successfully this servername will be saved in your local profile on the device you run it from. This should populate the saved servername upon re-running the tool. If there are any unknown errors running the tool verify the CUCM server version and change it accordingly, but the '12.5' value should suffice in most instances regardless of version.
- Upon clicking login you will be prompted to enter the server credentials, it is recommended to use the built in 'Admin' account as it will have rights to read/edit the CUCM database via the SOAP API this tool utilizes. Other accounts can be used but may need to have permissions edited in order for the tool to function properly.
Information on adding these permissions to an account in CUCM can be found here: https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/11_5_1/sysConfig/CUCM_BK_SE5DAF88_00_cucm-system-configuration-guide-1151/CUCM_BK_SE5DAF88_00_cucm-system-configuration-guide-1151_chapter_0100000.html
- Choose a date to look for accounts that have not logged in before. The tool defaults this date to 90 days prior to the current date. There are also buttons below the drop down that will change the selected date accordingly.
For example, in the above image the date January 18th, 2023 is selected. When we search for users in a future step, the tool will check Active Directory for user accounts that have not logged in since that date. Adjust this date to your desired search.
- The figure above shows the output of clicking 'Find Users' based only on the desired last logon date selected in the previous step. It takes the users found in Active Directory with the selected search options and finds users that currently have a device in CUCM/Jabber. This will then populate the list at the bottom of the form and provide information for each user found.
- If desired you can expand the search to include users in the discovered Disabled OU in your Active Directory structure. Since there may be more than one, select from the drop down the desired OU search location.
- There is also an option to include all discovered Disabled Users in case there are ones that have not been moved to a Disabled OU.
- Upon selecting the desired Date and Options, review the generated user list and determine which users you wish to remove Jabber/CUCM devices from. Check the box next to these users and click the 'Remove Devices' button.
- After clicking 'Remove Devices' you will start to see output in the console box showing the tasks to tool is conducting. Most success/error/failure output will be redirected to this console box. Upon completing the tasks for each selected user the tool will refresh the user list as final verification of removed devices. From here if desired you can copy/paste the console output to a text file to conduct any required Maintenance Logs.
I embedded my Icon in the source file as a base64 image (line 29), if you wish to change the icon just swap out the string there and rebuild the exe for your purposes using a complier like ps2exe. You can also edit the default server name in the source file (line 10) before compiling.
Submit any feature requests and feedback, the methods I used here can be leveraged for a large number of CUCM tasks, not just removing user devices, this was just a specific need and use case I had in the environment I work in to free up CUCM licenses that stale users in AD were holding.