Solved

Powershell query disabled Windows 2008 Active Directory users.

Posted on 2013-05-23
10
658 Views
Last Modified: 2013-05-26
I search the awhile and fell the need to ask, Is there a simple one line power shell command to query and and create an CSV report of disabled AD users for 90 days?
0
Comment
Question by:355LT1
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
  • 2
  • +1
10 Comments
 
LVL 42

Expert Comment

by:sedgwick
ID: 39190362
Search-ADAccount -AccountInactive -TimeSpan 90.00:00:00 | Export-Csv C:\temp\1.csv -NoTypeInformation

Open in new window

0
 
LVL 22

Expert Comment

by:Haresh Nikumbh
ID: 39190367
Get-QADUser -Disabled -SizeLimit 0 -ErrorAction SilentlyContinue -LastChangedAfter (Get-Date).AddDays(-90) |sort whenchanged  | ft name,whenchanged | Out-File c:\user.csv
0
 
LVL 42

Expert Comment

by:sedgwick
ID: 39190376
if u want to filter out disabled users (search only enabled users who didn't logged in in 90 days time) then use this one:
Search-ADAccount -AccountInactive -TimeSpan 90.00:00:00 | where {$_.enabled -eq $true} |  Export-Csv C:\temp\1.csv -NoTypeInformation

Open in new window

0
Backup Solution for AWS

Read about how CloudBerry Backup fully integrates your backups with Amazon S3 and Amazon Glacier to provide military-grade encryption and dramatically cut storage costs on any platform.

 
LVL 40

Expert Comment

by:Subsun
ID: 39191145
power shell command to query and and create an CSV report of disabled AD users for 90 days?
If you are looking for disabled account then you need to use Search-ADAccount with parameter -AccountDisabled
For example..
Search-ADAccount -AccountDisabled -UsersOnly | ?{$_ | Get-aduser -properties whenchanged | ?{$_.whenChanged -ge (Get-Date).AddDays(-90)}} | Select Name,SamAccountName,Enabled,LastLogonDate | Export-Csv C:\report.csv -NoTypeInformation

Open in new window

0
 

Author Comment

by:355LT1
ID: 39193413
Worked great, how can I specifiy for users in a specific OU.
0
 
LVL 42

Expert Comment

by:sedgwick
ID: 39193416
add -SearchBase, example:
Search-ADAccount -AccountInactive -Searchbase "OU=IT,DC=Contoso,DC=Com" -TimeSpan 90.00:00:00 | Export-Csv C:\temp\1.csv -NoTypeInformation

Open in new window

0
 
LVL 40

Expert Comment

by:Subsun
ID: 39193426
Use -SearchBase parameter with Search-ADAccount..
For example..
Search-ADAccount -AccountDisabled -UsersOnly -SearchBase “OU=User,DC=domain,DC=com” | ?{$_ | Get-aduser -properties whenchanged | ?{$_.whenChanged -ge (Get-Date).AddDays(-90)}} | Select Name,SamAccountName,Enabled,LastLogonDate | Export-Csv C:\report.csv -NoTypeInformation

Open in new window

0
 

Author Comment

by:355LT1
ID: 39193643
I tried on a member server I get an error Search-ADAccount is not a reconized name of a cmdlet, do I need to be running the ps command on a domain controller?
0
 
LVL 40

Accepted Solution

by:
Subsun earned 500 total points
ID: 39193658
You need to run this command where Activedirectory module is installed. If you have windows 2008 R2 domain then you should have this module already installed on your DC. Open powershell on DC and type following command and press enter..

Import-Module Activedirectory

After it return the prompt, try the Search-ADAccount command..
0
 
LVL 42

Expert Comment

by:sedgwick
ID: 39198568
that should be split points to say the least.
0

Featured Post

Does Powershell have you tied up in knots?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article explains the steps required to use the default Photos screensaver to display branding/corporate images
Always backup Domain, SYSVOL etc.using processes according to Microsoft Best Practices. This is meant as a disaster recovery process for small environments that did not implement backup processes and did not run a secondary domain controller that ne…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an antispam), the admini…

730 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question