script to check if a list of users' AD account is disabled.

Hello,

I have a text file which contains a user list and would like to create a script to check if their AD account is disabled and echo the names if they are.  

What command should I use in my script?

Thanks.
nav2567Asked:
Who is Participating?

[Webinar] Streamline your web hosting managementRegister Today

x
 
McKnifeConnect With a Mentor Commented:
> I also tried the other "simple line" but it did not work.
You tried it - on your DC? In order for it to work, is has to be executed on the DC. It works on mine (win2008 and 2012). If you need to execute it from a workstation, you need to add /domain, so that would be
for /f %a in (c:\test\users.txt) do net user %a /domain |findstr /C:"Account active               No" && echo %a is deactivated >>c:\test\deactivatedusers.txt

Open in new window


Tested that also, works, too.
0
 
Yagya ShreeConnect With a Mentor Commented:
Use below powershell script

Search-ADAccount -accountinactive -usersonly  | where {! ($_.lastlogondate -lt (get-date).addMonths(-6))} | ft Name,lastlogondate
0
 
nav2567Author Commented:
If my user text file is C:\USERS.TXT.  

Would you help me to create a script to read my USERS.TXT and list out all the "DISABLED" users?
0
Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

 
coraxalConnect With a Mentor Commented:
If you don't mind installing ActiveRoles Management Shell for Active Directory (Free PowerShell Commands for Active Directory), then you could do something like this:

http://www.quest.com/powershell/activeroles-server.aspx


$UserCol = Get-Content C:\users.txt

$UserCol | ForEach-Object {
       
        $user = Get-QADUser -SearchRoot "dc=yourdomain,dc=com" -Identity $_ -DontUseDefaultIncludedProperties -IncludedProperties AccountIsDisabled

       if($user.AccountIsDisabled){
             
               Write-Output "User account:  $($user.NTAccountName) is disabled"

        }
}

Open in new window

0
 
nav2567Author Commented:
Thanks.

Would you modify the script to output the disabled account names into c:\disabled-users.txt?

Also, what extension should I use to save this scipt so it will be opened by ActiveRoles Management Shell automatically when I double click on it?
0
 
McKnifeConnect With a Mentor Commented:
A simple line would do.
for /f %a in (c:\test\users.txt) do net user %a |findstr /C:"Account active               No" && echo %a is deactivated >>c:\test\deactivatedusers.txt

Open in new window


->Please scroll the code rightwards
0
 
coraxalCommented:
$UserCol = Get-Content C:\users.txt
$DisabledUsers = @()

$UserCol | ForEach-Object {
       
        $user = Get-QADUser -SearchRoot "dc=yourdomain,dc=com" -Identity $_ -DontUseDefaultIncludedProperties -IncludedProperties AccountIsDisabled

       if($user.AccountIsDisabled){
             
               Write-Output "User account:  $($user.NTAccountName) is disabled"
			   $DisabledUsers += $_.NTAccountName

        }
}

$DisabledUsers | Set-Content C:\DisabledUsers.txt

Open in new window



You'll have to save the script with a ".ps1" extension.  So say you save the script in C:\scripts, open up a shell window, cd to C:\scripts, and type the name of the script "myscript.ps1"
0
 
nav2567Author Commented:
I tried the first PS1 script yesterday and it works.  Thanks.

I also tried the other "simple line" but it did not work.  

I would like to look into one more option which is to use the Windows native command DSQUERY USER.  

Anyone knows how to do this?
0
 
jeorgeCommented:
hi check out this scripts written by Richard L Mueller

http://www.rlmueller.net/Programs/IsUserLocked.txt

Hope it works for you.
0
All Courses

From novice to tech pro — start learning today.