Solved

Script to determine date of AD user account disabling.

Posted on 2008-10-23
2
1,065 Views
Last Modified: 2012-05-05
I was wondering if anyone had a script or knew of where I could find a VBScript to search an entire OU and determine what date each user account was disabled on and return that to a file? I searched the Internet and couldn't find anything. My problem is that I have a bunch of disabled user accounts but the person who disabled them didn't put a comment in the description field and I need to know when they were disabled. Thank you.
0
Comment
Question by:mcpp661
2 Comments
 
LVL 18

Accepted Solution

by:
exx1976 earned 250 total points
ID: 22787134
Well, *IF* the accounts haven't been touched since they were disabled, you could always use    modifyTimeStamp

Or there is also              whenChanged


Or, assuming that the last logon was somewhere not too long before the account was disabled, you could use the             lastLogon         or maybe even the    lastLogoff          properties..

0
 
LVL 65

Assisted Solution

by:RobSampson
RobSampson earned 250 total points
ID: 22790628
exx is right....whenChanged is about the best you can do, although this doesn't help if say, the account was disabled in May, and then moved to another OU in August, then it would be inaccurate....

AD doesn't keep that information, unfortunately.

Regards,

Rob.
0

Featured Post

Top 6 Sources for Identifying Threat Actor TTPs

Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

Join & Write a Comment

Suggested Solutions

This script will sweep a range of IP addresses (class c only, 255.255.255.0) and report to a log the version of office installed. What it does: 1.)      Creates log file in the directory the script is run from (if it doesn't already exist) 2.)      Sweep…
Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now