Disable User account using GPO

# Read the input parameters $Subtree and $NbDays
 
param([string] $Subtree = $(throw write-host `
 
      "Please specify the DN of the container under which inactive accounts should be queried from." -Foregroundcolor Red),`
 
      [string] $NbDays = $(throw write-host `
 
      "Please specify the maximum number of days of inactivity allowed. Users who have not logged on for longer that the number of`
 
      days specified will get disabled." -Foregroundcolor Red))
 
 
 
# Get the current date
 
$currentDate = [System.DateTime]::Now
 
# Convert the local time to UTC format because all dates are expressed in UTC (GMT) format in Active Directory
 
$currentDateUtc = $currentDate.ToUniversalTime()
 
 
 
# Set the LDAP URL to the container DN specified on the command line
 
$LdapURL = "LDAP://" + $Subtree
 
 
 
# Initialize a DirectorySearcher object
 
$searcher = New-Object System.DirectoryServices.DirectorySearcher([ADSI]$LdapURL)
 
 
 
# Set the attributes that you want to be returned from AD
 
$searcher.PropertiesToLoad.Add("displayName") >$null
 
$searcher.PropertiesToLoad.Add("sAMAccountName") >$null
 
$searcher.PropertiesToLoad.Add("lastLogonTimeStamp") >$null
 
 
 
# Calculate the time stamp in Large Integer/Interval format using the $NbDays specified on the command line
 
$lastLogonTimeStampLimit = $currentDateUtc.AddDays(- $NbDays)
 
$lastLogonIntervalLimit = $lastLogonTimeStampLimit.ToFileTime()
 
 
 
Write-Host "Looking for all users that have not logged on since "$lastLogonTimeStampLimit" ("$lastLogonIntervalLimit")"
 
 
 
$searcher.Filter = "(&(objectCategory=person)(objectClass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(lastLogonTimeStamp<=`
 
" + $lastLogonIntervalLimit + "))"
 
 
 
# Run the LDAP Search request against AD
 
$users = $searcher.FindAll()
 
 
 
if ($users.Count -eq 0)
 
{
 
       Write-Host "  No account needs to be disabled.
 
}
 
else
 
{
 
       foreach ($user in $users)
 
       {
 
              # Read the user properties
 
              [string]$adsPath = $user.Properties.adspath
 
              [string]$displayName = $user.Properties.displayname
 
              [string]$samAccountName = $user.Properties.samaccountname
 
              [string]$lastLogonInterval = $user.Properties.lastlogontimestamp
 
 
 
              # Disable the user
 
              $account=[ADSI]$adsPath
 
              $account.psbase.invokeset("AccountDisabled", "True")
 
              $account.setinfo()
 
 
 
              # Convert the date and time to the local time zone
 
              $lastLogon = [System.DateTime]::FromFileTime($lastLogonInterval)
 
              
 
              Write-Host "  Disabled user "$displayName" ("$samAccountName") who last logged on "$lastLogon" ("$lastLogonInterval")"           
 
       }
 
}

                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:
109:
110:
111:
112:
113:
114:
115:
116:
117:
118:
119: