Link to home
Create AccountLog in
Avatar of 355LT1
355LT1

asked on

Powershell query disabled Windows 2008 Active Directory users.

I search the awhile and fell the need to ask, Is there a simple one line power shell command to query and and create an CSV report of disabled AD users for 90 days?
Avatar of Meir Rivkin
Meir Rivkin
Flag of Israel image

Search-ADAccount -AccountInactive -TimeSpan 90.00:00:00 | Export-Csv C:\temp\1.csv -NoTypeInformation

Open in new window

Get-QADUser -Disabled -SizeLimit 0 -ErrorAction SilentlyContinue -LastChangedAfter (Get-Date).AddDays(-90) |sort whenchanged  | ft name,whenchanged | Out-File c:\user.csv
if u want to filter out disabled users (search only enabled users who didn't logged in in 90 days time) then use this one:
Search-ADAccount -AccountInactive -TimeSpan 90.00:00:00 | where {$_.enabled -eq $true} |  Export-Csv C:\temp\1.csv -NoTypeInformation

Open in new window

power shell command to query and and create an CSV report of disabled AD users for 90 days?
If you are looking for disabled account then you need to use Search-ADAccount with parameter -AccountDisabled
For example..
Search-ADAccount -AccountDisabled -UsersOnly | ?{$_ | Get-aduser -properties whenchanged | ?{$_.whenChanged -ge (Get-Date).AddDays(-90)}} | Select Name,SamAccountName,Enabled,LastLogonDate | Export-Csv C:\report.csv -NoTypeInformation

Open in new window

Avatar of 355LT1
355LT1

ASKER

Worked great, how can I specifiy for users in a specific OU.
add -SearchBase, example:
Search-ADAccount -AccountInactive -Searchbase "OU=IT,DC=Contoso,DC=Com" -TimeSpan 90.00:00:00 | Export-Csv C:\temp\1.csv -NoTypeInformation

Open in new window

Use -SearchBase parameter with Search-ADAccount..
For example..
Search-ADAccount -AccountDisabled -UsersOnly -SearchBase “OU=User,DC=domain,DC=com” | ?{$_ | Get-aduser -properties whenchanged | ?{$_.whenChanged -ge (Get-Date).AddDays(-90)}} | Select Name,SamAccountName,Enabled,LastLogonDate | Export-Csv C:\report.csv -NoTypeInformation

Open in new window

Avatar of 355LT1

ASKER

I tried on a member server I get an error Search-ADAccount is not a reconized name of a cmdlet, do I need to be running the ps command on a domain controller?
ASKER CERTIFIED SOLUTION
Avatar of SubSun
SubSun
Flag of India image

Link to home
membership
Create an account to see this answer
Signing up is free. No credit card required.
Create Account
that should be split points to say the least.