Link to home
Start Free TrialLog in
Avatar of Bianchi928
Bianchi928

asked on

Active accounts

How can I modify this script to show the active accounts instead of disabled ones.

Thanks
Cheers


Const ADS_UF_ACCOUNTDISABLE = 2


Set objFSO = CreateObject("Scripting.FileSystemObject")
Set WshShell  = CreateObject("WScript.Shell")

LogFile = "D:\temp\logfile.txt"

Const intForAppending = 8
Set objOutput = objFSO.CreateTextFile(LogFile, intForAppending, False)

Set objConnection = CreateObject("ADODB.Connection")
objConnection.Open "Provider=ADsDSOObject;"
Set objCommand = CreateObject("ADODB.Command")
objCommand.ActiveConnection = objConnection
objCommand.CommandText = _
    "<GC://dc=sptyres,dc=com,dc=au>;(objectCategory=User)" & _
        ";userAccountControl,distinguishedName;subtree"  
Set objRecordSet = objCommand.Execute
 
intCounter = 0
Do Until objRecordset.EOF
    intUAC=objRecordset.Fields("userAccountControl")
    If intUAC AND ADS_UF_ACCOUNTDISABLE Then
        ObjOutput.WriteLine objRecordset.Fields("distinguishedName") & " is disabled"
        intCounter = intCounter + 1
    End If
    objRecordset.MoveNext
Loop
 
WScript.Echo VbCrLf & "A total of " & intCounter & " accounts are disabled."
 
objConnection.Close
Avatar of RobSampson
RobSampson
Flag of Australia image

Hi, I haven't tested it, but maybe just change this:
   If intUAC AND ADS_UF_ACCOUNTDISABLE Then

to this:
   If NOT intUAC AND ADS_UF_ACCOUNTDISABLE Then

Regards,

Rob.
Avatar of Bianchi928
Bianchi928

ASKER

I just tested that and it doesn't seem alright to me. I specifically looked for an active account and it wasn't in the log.
OK, I can't find it right now, but you can just change the logic by changing this:
    If intUAC AND ADS_UF_ACCOUNTDISABLE Then
        ObjOutput.WriteLine objRecordset.Fields("distinguishedName") & " is disabled"
        intCounter = intCounter + 1
    End If

to this
    If intUAC AND ADS_UF_ACCOUNTDISABLE Then
    Else
        ObjOutput.WriteLine objRecordset.Fields("distinguishedName") & " is enabled"
        intCounter = intCounter + 1
    End If


Regards,

Rob.
Still not good...For starters the disable script is not good...It shows..let say 710 ..but when I manually checked on the AD it shows more than 1000..I don't know what's wrong..
ASKER CERTIFIED SOLUTION
Avatar of RobSampson
RobSampson
Flag of Australia image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
If you want to switch the same code back to show disabled users, remove the ! from CommandText filter.
Perfect mate.. Successfully tested both
Thanks
Cheers
Perfect
Great. Thanks.