• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 2486
  • Last Modified:

Bulk user account disable in Active Directory 2008 R2

Hi,

I have a list of some 900+ people who have left our organisation in the past year and a half.  For one reason or another these accounts are still live in our new Active Directory environment and I need a script, preferably a PowerShell script to disable all of these accounts.  The only unique information I have for each user is their payroll number (which in AD is listed as their UID attribute), I do not have the sAMAccountname for any of these accounts.

A script is needed to import the UID from a CSV file, to find that user in AD based on their UID, and then to disable the accounts.  I’d also like to populate the ‘Description’ field for each of these users essentially saying that they are disabled accounts, when they were disabled and by whom.

Any help gratefully received!
1
rookie_b
Asked:
rookie_b
  • 2
2 Solutions
 
SeanSystem EngineerCommented:
When you say UID what do you mean exactly? are you talking EmployeeID?

you should be able to do this:

$users = import-csv <csv File>
foreach($user in $user){disable-aduser $user.Name}

your CSV will need a header with Name for the user's name.
If the attribute you are talking about is not something that can be filtered like this let me know.
0
 
SubsunCommented:
Put the UID's which you want to disable in a text file and run below code against it
Import-Module Activedirectory
Foreach ($Uid in (GC C:\uid.txt)){
$User = Get-ADUser -Filter {uid -eq $UID}
	If ($User -ne $null){
	Disable-ADAccount $User.sAMAccountname
	}
}

Open in new window

0
 
rookie_bAuthor Commented:
Hi, thanks all for replying.  We use FIM to provision our accounts into AD from other data sources.  We have employee numbers which FIM maps to the 'uid' attribute for a user thus keeping all the accounts unique.

The problem is that I need to find the sAMAccountname for each of these 900+ users and then disable those accounts.  All I have is their employee number (which FIM maps to the uid attribute for a user in AD) and their actual name (we have some 20,000 users so actual names are not of any use really).
0
 
SubsunCommented:
Following code will export the list of matching accounts..
Import-Module Activedirectory
$(Foreach ($Uid in (GC C:\uid.txt)){
$User = Get-ADUser -Filter {uid -eq $UID} -Properties *
	If ($User -ne $null){
	$User | Select sAMAccountname,UID
	}
	Else{
	"" | Select @{N="sAMAccountname";E={"Not found"}},@{N="UID";E={$Uid}}
	}
}) | Export-Csv C:\report.csv -NTI

Open in new window

Following code will disable the accounts based on the csv file..
Import-Module Activedirectory
Import-Csv C:\report.csv | % {Disable-ADAccount $_.sAMAccountname}

Open in new window

0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Cloud Class® Course: Certified Penetration Testing

This CPTE Certified Penetration Testing Engineer course covers everything you need to know about becoming a Certified Penetration Testing Engineer. Career Path: Professional roles include Ethical Hackers, Security Consultants, System Administrators, and Chief Security Officers.

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now