Solved

Powershell query disabled Windows 2008 Active Directory users.

Posted on 2013-05-23
10
659 Views
Last Modified: 2013-05-26
I search the awhile and fell the need to ask, Is there a simple one line power shell command to query and and create an CSV report of disabled AD users for 90 days?
0
Comment
Question by:355LT1
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
  • 2
  • +1
10 Comments
 
LVL 42

Expert Comment

by:sedgwick
ID: 39190362
Search-ADAccount -AccountInactive -TimeSpan 90.00:00:00 | Export-Csv C:\temp\1.csv -NoTypeInformation

Open in new window

0
 
LVL 22

Expert Comment

by:Haresh Nikumbh
ID: 39190367
Get-QADUser -Disabled -SizeLimit 0 -ErrorAction SilentlyContinue -LastChangedAfter (Get-Date).AddDays(-90) |sort whenchanged  | ft name,whenchanged | Out-File c:\user.csv
0
 
LVL 42

Expert Comment

by:sedgwick
ID: 39190376
if u want to filter out disabled users (search only enabled users who didn't logged in in 90 days time) then use this one:
Search-ADAccount -AccountInactive -TimeSpan 90.00:00:00 | where {$_.enabled -eq $true} |  Export-Csv C:\temp\1.csv -NoTypeInformation

Open in new window

0
Free NetCrunch network monitor licenses!

Only on Experts-Exchange: Sign-up for a free-trial and we'll send you your permanent license!

Here is what you get: 30 Nodes | Unlimited Sensors | No Time Restrictions | Absolutely FREE!

Act now. This offer ends July 14, 2017.

 
LVL 40

Expert Comment

by:Subsun
ID: 39191145
power shell command to query and and create an CSV report of disabled AD users for 90 days?
If you are looking for disabled account then you need to use Search-ADAccount with parameter -AccountDisabled
For example..
Search-ADAccount -AccountDisabled -UsersOnly | ?{$_ | Get-aduser -properties whenchanged | ?{$_.whenChanged -ge (Get-Date).AddDays(-90)}} | Select Name,SamAccountName,Enabled,LastLogonDate | Export-Csv C:\report.csv -NoTypeInformation

Open in new window

0
 

Author Comment

by:355LT1
ID: 39193413
Worked great, how can I specifiy for users in a specific OU.
0
 
LVL 42

Expert Comment

by:sedgwick
ID: 39193416
add -SearchBase, example:
Search-ADAccount -AccountInactive -Searchbase "OU=IT,DC=Contoso,DC=Com" -TimeSpan 90.00:00:00 | Export-Csv C:\temp\1.csv -NoTypeInformation

Open in new window

0
 
LVL 40

Expert Comment

by:Subsun
ID: 39193426
Use -SearchBase parameter with Search-ADAccount..
For example..
Search-ADAccount -AccountDisabled -UsersOnly -SearchBase “OU=User,DC=domain,DC=com” | ?{$_ | Get-aduser -properties whenchanged | ?{$_.whenChanged -ge (Get-Date).AddDays(-90)}} | Select Name,SamAccountName,Enabled,LastLogonDate | Export-Csv C:\report.csv -NoTypeInformation

Open in new window

0
 

Author Comment

by:355LT1
ID: 39193643
I tried on a member server I get an error Search-ADAccount is not a reconized name of a cmdlet, do I need to be running the ps command on a domain controller?
0
 
LVL 40

Accepted Solution

by:
Subsun earned 500 total points
ID: 39193658
You need to run this command where Activedirectory module is installed. If you have windows 2008 R2 domain then you should have this module already installed on your DC. Open powershell on DC and type following command and press enter..

Import-Module Activedirectory

After it return the prompt, try the Search-ADAccount command..
0
 
LVL 42

Expert Comment

by:sedgwick
ID: 39198568
that should be split points to say the least.
0

Featured Post

Free NetCrunch network monitor licenses!

Only on Experts-Exchange: Sign-up for a free-trial and we'll send you your permanent license!

Here is what you get: 30 Nodes | Unlimited Sensors | No Time Restrictions | Absolutely FREE!

Act now. This offer ends July 14, 2017.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Had a business requirement to store the mobile number in an environmental variable. This is just a quick article on how this was done.
After seeing many questions for JRNL_WRAP_ERROR for replication failure, I thought it would be useful to write this article.
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an antispam), the admini…

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question