?
Solved

PowerShell Checking for disabled accounts.

Posted on 2011-02-26
3
Medium Priority
?
960 Views
Last Modified: 2012-05-11
Hi all,

if there is anybody here that can help me I would be greatly appreciative, i have wrote a very basic script to look for disabled accounts etc, and account lock outs.

adding the 512 (normal account) to the 16 for lockout. Example below:

$search.Filter = “(&(objectClass=user)(userAccountControl=528))

but this is not working :( if I do 512 instead of the 528 i get a list of accounts, can anyone see what I am doing wrong?

Regards

Daniel
0
Comment
Question by:EastThames
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
3 Comments
 
LVL 16

Assisted Solution

by:Dale Harris
Dale Harris earned 664 total points
ID: 34988852
If you use the Quest CMDlets, you can do a command a little easier:

get-qaduser -disabled

I think 514 is the number you're looking for though.

http://social.technet.microsoft.com/Forums/en/winserverDS/thread/7ff0fb2f-0cd1-44a9-b172-7abd196ee617

HTH,

Dale Harris
0
 
LVL 49

Accepted Solution

by:
Akhater earned 668 total points
ID: 34989396
Here you go for a more "native" approach

$searcher = new-object DirectoryServices.DirectorySearcher([ADSI]“”)
$searcher.filter = “(&(objectClass=user)(userAccountControl=514))
$users = $searcher.findall()
0
 
LVL 27

Assisted Solution

by:KenMcF
KenMcF earned 668 total points
ID: 34989505
I agree with Dale, the Quest tools would be the best to use here. But if you want to use what you have an LDAP query for 514 is not the right way to do this. You need to get the UserAccoutnControl attribute and a Value of 2 (Account Disabled) and a value of 512 (Normal User) may get most of your disbaled account, it will not get an accurate could. You will want to modify your search filter like this

“(&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=2))"

You want to see if Bit 2 has been enabled.


http://support.microsoft.com/kb/305144

0

Featured Post

Four New Appliances. Same Industry-leading Speeds.

But don't take it from us.  The Firebox M370 is Miercom tested and Miercom approved, outperforming its competitors for stateless and stateful traffic throughput scenarios.  Learn more about the M370, M470, M570 and M670 and find the right solution for your organization today!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In previous parts of this Nano Server deployment series, we learned how to create, deploy and configure Nano Server as a Hyper-V host. In this part, we will look for a clustering option. We will create a Hyper-V cluster of 3 Nano Server host nodes w…
In this post we will be converting StringData saved within a text file into a hash table. This can be further used in a PowerShell script for replacing settings that are dynamic in nature from environment to environment.
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an antispam), the admini…
In this video, Percona Director of Solution Engineering Jon Tobin discusses the function and features of Percona Server for MongoDB. How Percona can help Percona can help you determine if Percona Server for MongoDB is the right solution for …

770 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question