Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

Bulk user account disable in Active Directory 2008 R2

Posted on 2013-12-12
4
Medium Priority
?
2,335 Views
1 Endorsement
Last Modified: 2014-01-02
Hi,

I have a list of some 900+ people who have left our organisation in the past year and a half.  For one reason or another these accounts are still live in our new Active Directory environment and I need a script, preferably a PowerShell script to disable all of these accounts.  The only unique information I have for each user is their payroll number (which in AD is listed as their UID attribute), I do not have the sAMAccountname for any of these accounts.

A script is needed to import the UID from a CSV file, to find that user in AD based on their UID, and then to disable the accounts.  I’d also like to populate the ‘Description’ field for each of these users essentially saying that they are disabled accounts, when they were disabled and by whom.

Any help gratefully received!
1
Comment
Question by:rookie_b
  • 2
4 Comments
 
LVL 11

Expert Comment

by:Sean
ID: 39714414
When you say UID what do you mean exactly? are you talking EmployeeID?

you should be able to do this:

$users = import-csv <csv File>
foreach($user in $user){disable-aduser $user.Name}

your CSV will need a header with Name for the user's name.
If the attribute you are talking about is not something that can be filtered like this let me know.
0
 
LVL 40

Assisted Solution

by:Subsun
Subsun earned 2000 total points
ID: 39714459
Put the UID's which you want to disable in a text file and run below code against it
Import-Module Activedirectory
Foreach ($Uid in (GC C:\uid.txt)){
$User = Get-ADUser -Filter {uid -eq $UID}
	If ($User -ne $null){
	Disable-ADAccount $User.sAMAccountname
	}
}

Open in new window

0
 

Author Comment

by:rookie_b
ID: 39715947
Hi, thanks all for replying.  We use FIM to provision our accounts into AD from other data sources.  We have employee numbers which FIM maps to the 'uid' attribute for a user thus keeping all the accounts unique.

The problem is that I need to find the sAMAccountname for each of these 900+ users and then disable those accounts.  All I have is their employee number (which FIM maps to the uid attribute for a user in AD) and their actual name (we have some 20,000 users so actual names are not of any use really).
0
 
LVL 40

Accepted Solution

by:
Subsun earned 2000 total points
ID: 39716107
Following code will export the list of matching accounts..
Import-Module Activedirectory
$(Foreach ($Uid in (GC C:\uid.txt)){
$User = Get-ADUser -Filter {uid -eq $UID} -Properties *
	If ($User -ne $null){
	$User | Select sAMAccountname,UID
	}
	Else{
	"" | Select @{N="sAMAccountname";E={"Not found"}},@{N="UID";E={$Uid}}
	}
}) | Export-Csv C:\report.csv -NTI

Open in new window

Following code will disable the accounts based on the csv file..
Import-Module Activedirectory
Import-Csv C:\report.csv | % {Disable-ADAccount $_.sAMAccountname}

Open in new window

0

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Active Directory can easily get cluttered with unused service, user and computer accounts. In this article, I will show you the way I like to implement ADCleanup..
Wouldn't it be nice if objects in Active Directory automatically moved into the correct Organizational Units? This is what AutoAD aims to do and as a plus, it automatically creates Sites, Subnets, and Organizational Units.
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …
Attackers love to prey on accounts that have privileges. Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …

963 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question