Solved

script to check if a list of users' AD account is disabled.

Posted on 2013-01-17
9
5,950 Views
Last Modified: 2013-02-01
Hello,

I have a text file which contains a user list and would like to create a script to check if their AD account is disabled and echo the names if they are.  

What command should I use in my script?

Thanks.
0
Comment
Question by:nav2567
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
  • 2
  • +2
9 Comments
 
LVL 13

Assisted Solution

by:Yagya Shree
Yagya Shree earned 125 total points
ID: 38788521
Use below powershell script

Search-ADAccount -accountinactive -usersonly  | where {! ($_.lastlogondate -lt (get-date).addMonths(-6))} | ft Name,lastlogondate
0
 

Author Comment

by:nav2567
ID: 38788907
If my user text file is C:\USERS.TXT.  

Would you help me to create a script to read my USERS.TXT and list out all the "DISABLED" users?
0
 
LVL 5

Assisted Solution

by:coraxal
coraxal earned 125 total points
ID: 38788966
If you don't mind installing ActiveRoles Management Shell for Active Directory (Free PowerShell Commands for Active Directory), then you could do something like this:

http://www.quest.com/powershell/activeroles-server.aspx


$UserCol = Get-Content C:\users.txt

$UserCol | ForEach-Object {
       
        $user = Get-QADUser -SearchRoot "dc=yourdomain,dc=com" -Identity $_ -DontUseDefaultIncludedProperties -IncludedProperties AccountIsDisabled

       if($user.AccountIsDisabled){
             
               Write-Output "User account:  $($user.NTAccountName) is disabled"

        }
}

Open in new window

0
Optimizing Cloud Backup for Low Bandwidth

With cloud storage prices going down a growing number of SMBs start to use it for backup storage. Unfortunately, business data volume rarely fits the average Internet speed. This article provides an overview of main Internet speed challenges and reveals backup best practices.

 

Author Comment

by:nav2567
ID: 38789306
Thanks.

Would you modify the script to output the disabled account names into c:\disabled-users.txt?

Also, what extension should I use to save this scipt so it will be opened by ActiveRoles Management Shell automatically when I double click on it?
0
 
LVL 54

Assisted Solution

by:McKnife
McKnife earned 250 total points
ID: 38789400
A simple line would do.
for /f %a in (c:\test\users.txt) do net user %a |findstr /C:"Account active               No" && echo %a is deactivated >>c:\test\deactivatedusers.txt

Open in new window


->Please scroll the code rightwards
0
 
LVL 5

Expert Comment

by:coraxal
ID: 38789595
$UserCol = Get-Content C:\users.txt
$DisabledUsers = @()

$UserCol | ForEach-Object {
       
        $user = Get-QADUser -SearchRoot "dc=yourdomain,dc=com" -Identity $_ -DontUseDefaultIncludedProperties -IncludedProperties AccountIsDisabled

       if($user.AccountIsDisabled){
             
               Write-Output "User account:  $($user.NTAccountName) is disabled"
			   $DisabledUsers += $_.NTAccountName

        }
}

$DisabledUsers | Set-Content C:\DisabledUsers.txt

Open in new window



You'll have to save the script with a ".ps1" extension.  So say you save the script in C:\scripts, open up a shell window, cd to C:\scripts, and type the name of the script "myscript.ps1"
0
 

Author Comment

by:nav2567
ID: 38792540
I tried the first PS1 script yesterday and it works.  Thanks.

I also tried the other "simple line" but it did not work.  

I would like to look into one more option which is to use the Windows native command DSQUERY USER.  

Anyone knows how to do this?
0
 
LVL 3

Expert Comment

by:jeorge
ID: 38792633
hi check out this scripts written by Richard L Mueller

http://www.rlmueller.net/Programs/IsUserLocked.txt

Hope it works for you.
0
 
LVL 54

Accepted Solution

by:
McKnife earned 250 total points
ID: 38792818
> I also tried the other "simple line" but it did not work.
You tried it - on your DC? In order for it to work, is has to be executed on the DC. It works on mine (win2008 and 2012). If you need to execute it from a workstation, you need to add /domain, so that would be
for /f %a in (c:\test\users.txt) do net user %a /domain |findstr /C:"Account active               No" && echo %a is deactivated >>c:\test\deactivatedusers.txt

Open in new window


Tested that also, works, too.
0

Featured Post

On Demand Webinar - Networking for the Cloud Era

This webinar discusses:
-Common barriers companies experience when moving to the cloud
-How SD-WAN changes the way we look at networks
-Best practices customers should employ moving forward with cloud migration
-What happens behind the scenes of SteelConnect’s one-click button

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A company’s centralized system that manages user data, security, and distributed resources is often a focus of criminal attention. Active Directory (AD) is no exception. In truth, it’s even more likely to be targeted due to the number of companies …
Active Directory security has been a hot topic of late, and for good reason. With 90% of the world’s organization using this system to manage access to all parts of their IT infrastructure, knowing how to protect against threats and keep vulnerabil…
This tutorial will walk an individual through configuring a drive on a Windows Server 2008 to perform shadow copies in order to quickly recover deleted files and folders. Click on Start and then select Computer to view the available drives on the se…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…

756 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question