DisableNetAdapter

<#############################################################
Disable the network adapter of the selected user
#############################################################>


# Set the username to disable

$user = "testuser"

#Get list of online computers
Get-ADComputer -Filter * |

# Test each computer in the AD list for response and Store that list
ForEach-Object {

  $rtn = Test-Connection -CN $_.dnshostname -Count 1 -BufferSize 16 -Quiet

  IF($rtn -match ‘True’) {$_.dnshostname | Out-File c:\onlinepc.txt -Append
   write-host -ForegroundColor green $_.dnshostname}

  ELSE { Write-host -ForegroundColor red $_.dnshostname }

}

$opc = Get-Content C:\onlinepc.txt

#Find the users that are logged in on the online pc's
Invoke-Command $opc {(quser) -replace '\s{2,}', ',' | ConvertFrom-Csv} | Export-Csv c:\qusr.csv
#Get the computer name that the user is logged into
$pc = Import-Csv C:\qusr.csv | where USERNAME -Like "$user" | select PSComputername
$pc = $pc -replace "}"
$pc = $pc -replace "@{PSComputerName="

#Popup message on the disabled pc
$server = $pc;
$message = "Attention $user!
Your network connection has been disabled due to a possible virus infection!
Do NOT attempt to re-enable it. Contact I.T immediately!";
Invoke-WmiMethod -Class win32_process -ComputerName $server -Name create -ArgumentList `
 "c:\windows\system32\msg.exe * $message"

#Disable any connected net adapter
$test = Get-WmiObject -Class win32_networkadapter -computerName $pc -filter "NetConnectionStatus = 2"
$test.disable()

# Cleanup files not needed
Remove-Item c:\qusr.csv
Remove-Item C:\onlinepc.txt