Remote wiping a managed computer

Question

I'm an MSP with a client across the country who is selling one of their branches. The computers they have (some Windows 7 and some Windows 10) are also being acquired. The computers are on a domain with a specific company image, in Active Directory, and have a lot of personal data and user accounts.

Currently I have a Powershell script that can run and manually remove most of the data. Sometimes this leaves things behind, creating security risks,and isn't time efficient (takes a couple of hours requiring occasional inputs).

So the question: How could I remotely wipe computers that I manage?

My colleague is convinced that utilizing sysprep should serve our purpose, but these machines have already been "sysprepped" before and I haven't had much luck on a local device. The people at the property are entirely computer illiterate, so sending a USB with an image and having them do it is out of the question.

I've been trying to use PowerShell to serve my purpose, but something always seems to go incorrectly (not deleting local user accounts, not renaming the PC, not being removed from the domain, etc). I'm more of a C# and Python guy without too much experience in PowerShell besides minor scripts to automate minor tasks.

Ultimately, I would like to script the following:

• Remove the computer from the domain
• Rename the computer to something generic
• Remove the user accounts and create a standard for the new user
• Erase all of the data

Here's a general idea of what I've tried thus far:

Remove-Computer -UnjoinDomainCredential domain\user

Rename-Computer -NewName "PC123" -DomainCredential domain\user

PS C:> Remove-LocalUser -Name "companyadmin"

systemreset -cleanpc

Should I continue focusing on PowerShell, and if so, any tips how this can be achieved? Should I take another look at sysprep? Or is there something else that I can utilize to remotely wipe managed devices. It doesn't have to be OOBE or anything, I just need them wiped with all of the company information.

Thank you for reading, and thank you ahead of time for any suggestions.

Answer 1

Wiping a computer from all its data requires :

• Resetting it to factory condition
• Wiping all data

For the first, you could either instruct your users in how to reset their computers, of you could use Microsoft's Refresh Windows utility (see writeup).

For the second, you should wipe all unused disk space, since it can be used to recover deleted files. See for example the article 8 Free Tools to Securely Wipe Free Disk Space Preventing Recovery.