[2 days left] What’s wrong with your cloud strategy? Learn why multicloud solutions matter with Nimble Storage.Register Now

x
?
Solved

Powershell query disabled Windows 2008 Active Directory users.

Posted on 2013-05-23
10
Medium Priority
?
662 Views
Last Modified: 2013-05-26
I search the awhile and fell the need to ask, Is there a simple one line power shell command to query and and create an CSV report of disabled AD users for 90 days?
0
Comment
Question by:355LT1
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
  • 2
  • +1
10 Comments
 
LVL 42

Expert Comment

by:Meir Rivkin
ID: 39190362
Search-ADAccount -AccountInactive -TimeSpan 90.00:00:00 | Export-Csv C:\temp\1.csv -NoTypeInformation

Open in new window

0
 
LVL 22

Expert Comment

by:Haresh Nikumbh
ID: 39190367
Get-QADUser -Disabled -SizeLimit 0 -ErrorAction SilentlyContinue -LastChangedAfter (Get-Date).AddDays(-90) |sort whenchanged  | ft name,whenchanged | Out-File c:\user.csv
0
 
LVL 42

Expert Comment

by:Meir Rivkin
ID: 39190376
if u want to filter out disabled users (search only enabled users who didn't logged in in 90 days time) then use this one:
Search-ADAccount -AccountInactive -TimeSpan 90.00:00:00 | where {$_.enabled -eq $true} |  Export-Csv C:\temp\1.csv -NoTypeInformation

Open in new window

0
Visualize your virtual and backup environments

Create well-organized and polished visualizations of your virtual and backup environments when planning VMware vSphere, Microsoft Hyper-V or Veeam deployments. It helps you to gain better visibility and valuable business insights.

 
LVL 40

Expert Comment

by:Subsun
ID: 39191145
power shell command to query and and create an CSV report of disabled AD users for 90 days?
If you are looking for disabled account then you need to use Search-ADAccount with parameter -AccountDisabled
For example..
Search-ADAccount -AccountDisabled -UsersOnly | ?{$_ | Get-aduser -properties whenchanged | ?{$_.whenChanged -ge (Get-Date).AddDays(-90)}} | Select Name,SamAccountName,Enabled,LastLogonDate | Export-Csv C:\report.csv -NoTypeInformation

Open in new window

0
 

Author Comment

by:355LT1
ID: 39193413
Worked great, how can I specifiy for users in a specific OU.
0
 
LVL 42

Expert Comment

by:Meir Rivkin
ID: 39193416
add -SearchBase, example:
Search-ADAccount -AccountInactive -Searchbase "OU=IT,DC=Contoso,DC=Com" -TimeSpan 90.00:00:00 | Export-Csv C:\temp\1.csv -NoTypeInformation

Open in new window

0
 
LVL 40

Expert Comment

by:Subsun
ID: 39193426
Use -SearchBase parameter with Search-ADAccount..
For example..
Search-ADAccount -AccountDisabled -UsersOnly -SearchBase “OU=User,DC=domain,DC=com” | ?{$_ | Get-aduser -properties whenchanged | ?{$_.whenChanged -ge (Get-Date).AddDays(-90)}} | Select Name,SamAccountName,Enabled,LastLogonDate | Export-Csv C:\report.csv -NoTypeInformation

Open in new window

0
 

Author Comment

by:355LT1
ID: 39193643
I tried on a member server I get an error Search-ADAccount is not a reconized name of a cmdlet, do I need to be running the ps command on a domain controller?
0
 
LVL 40

Accepted Solution

by:
Subsun earned 1500 total points
ID: 39193658
You need to run this command where Activedirectory module is installed. If you have windows 2008 R2 domain then you should have this module already installed on your DC. Open powershell on DC and type following command and press enter..

Import-Module Activedirectory

After it return the prompt, try the Search-ADAccount command..
0
 
LVL 42

Expert Comment

by:Meir Rivkin
ID: 39198568
that should be split points to say the least.
0

Featured Post

Free Backup Tool for VMware and Hyper-V

Restore full virtual machine or individual guest files from 19 common file systems directly from the backup file. Schedule VM backups with PowerShell scripts. Set desired time, lean back and let the script to notify you via email upon completion.  

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

How to deal with a specific error when using the Enable-RemoteMailbox cmdlet to create a mailbox in the cloud-based service, for an existing user in an on-premises Active Directory.
A bad practice commonly found during an account life cycle is to set its password to an initial, insecure password. The Password Reset Tool was developed to make the password reset process easier and more secure.
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an antispam), the admini…
Suggested Courses

649 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question