?
Solved

what is the syntax to expire an account in AD via Quest Powershell

Posted on 2013-12-03
9
Medium Priority
?
681 Views
Last Modified: 2013-12-03
trying to expire an account via Quest Powershell but the date syntax is not working correctly

Set-QADUser -Identity testuser1 -AccountExpires 2013-12-20

After the script runs, the account gets set to expire but the DAY is off by 2 days....

so it sets to expure on 2013-15-20 instead of 2013-12-20

thoughts?
0
Comment
Question by:ARM2009
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 4
9 Comments
 
LVL 53

Expert Comment

by:Will Szymkowski
ID: 39693129
If you want you can also accomplish this from built in AD. Use the below script.

# Import the Active Directory module if not already loaded
if (-not (Get-Module ActiveDirectory)){
    Import-Module ActiveDirectory -ErrorAction Stop
}

#This section grabs the username you supply, to use in later command
$username = read-host "Please enter the username"

#This section grabs the date/time to use in later command
$expires = read-host "Please enter the time to expire in format [MM/DD/YYYY H:MM:SS PM]"

#This command takes the previous 2 inputs and executes the command.
Set-ADUser $username -AccountExpirationDate "$expires"

# end of script

Open in new window


Reference - http://community.spiceworks.com/scripts/show/1719-set-account-expiration-granular

Will.
0
 
LVL 37

Expert Comment

by:Jamie McKillop
ID: 39693224
Hello,

Set the specific time you want it to expire in this format:

"12/21/2013 12:00:00 AM"

The time is in GMT. If you are in the GMT time zone, this would set the account to expire at the end of 12/20/2013. For example, if you were in the eastern time zone and wanted it to expire at the end of 12/20/2013, you would set it to "12/21/2013 5:00:00 AM"

-JJ
0
 

Author Comment

by:ARM2009
ID: 39693247
i set the following

set-Qaduser -identity username -AccountExpires "12/21/2013 5:00:00 AM"

my result is as follows

in ADUC account shows to expire on

Thursday, December 19, 2013

still seeing that 2 day difference....
0
Office 365 Training for Admins - 7 Day Trial

Learn how to provision tenants, synchronize on-premise Active Directory, implement Single Sign-On, customize Office deployment, and protect your organization with eDiscovery and DLP policies.  Only from Platform Scholar.

 
LVL 37

Expert Comment

by:Jamie McKillop
ID: 39693265
Run Get-QADUser -Identity username | select accountexpires

Let me know what value is returned.

-JJ
0
 

Author Comment

by:ARM2009
ID: 39693276
AccountExpires
--------------
12/20/2013 11:00:00 PM

in ADUC

Thursday, December 19, 2013
0
 
LVL 37

Expert Comment

by:Jamie McKillop
ID: 39693286
OK, so your time zone is GMT -6. You would use the time "12/21/2013 6:00:00 AM" to have it expire at the end of 12/20/2013.

-JJ
0
 

Author Comment

by:ARM2009
ID: 39693288
seems like the data

AccountExpires
--------------
12/20/2013 11:00:00 PM

shows correct per the script ("12/21/2013 5:00:00 AM") ... but info in ADUC is not correlating.
0
 
LVL 37

Accepted Solution

by:
Jamie McKillop earned 500 total points
ID: 39693307
The issue here is that when you set the expiration in ADUC, you set "end of" and not a specific time. So, if you set it to 12/20/2013 in ADUC, the value of AccountExpires would be set to 12/21/2013 12:00:00 AM. The ADUC interface will always report the day prior to the actual date set on the attribute because it isn't specific enough to report the exact time. The account will actually expire at the exact time if set using powershell. The other issue is that the time entered in powershell is GMT, so you need to shift for your time zone.

As I said above, if you set the value to "12/21/2013 6:00:00 AM", ADUC will reflect what you want.

-JJ
0
 

Author Comment

by:ARM2009
ID: 39693334
thanks JJ.
0

Featured Post

Free learning courses: Active Directory Deep Dive

Get a firm grasp on your IT environment when you learn Active Directory best practices with Veeam! Watch all, or choose any amount, of this three-part webinar series to improve your skills. From the basics to virtualization and backup, we got you covered.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you troubleshoot Outlook for clients, you may want to know a bit more about the OST file before doing your next job. IMAP can cause a lot of drama if removed in the accounts without backing up.
In the absence of a fully-fledged GPO Management product like AGPM, the script in this article will provide you with a simple way to watch the domain (or a select OU) for GPOs changes and automatically take backups when policies are added, removed o…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.
Suggested Courses
Course of the Month14 days, 4 hours left to enroll

801 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question