Avatar of cmatchett
cmatchett
Flag for United Kingdom of Great Britain and Northern Ireland asked on

Active Directory / Powershell / disable accounts

Hi,

I would like to disable Active Directory accounts that haven't been used in 30 days and who reside in a specific OU.

thanks in advance
PowershellActive Directory

Avatar of undefined
Last Comment
cmatchett

8/22/2022 - Mon
Raheman M. Abdul

$searchOU=“OU=Accounts,OU=RootOU,DC=ChildDomain,DC=RootDomain,DC=com"

get-aduser -SearchBase $searchOU -filter * -properties lastlogondate | Where-Object {$_.enabled -eq "true"-and $_.lastlogondate -lt (get-date).adddays(-30)} | Set-Aduser -enabled $false
cmatchett

ASKER
If i would like to write which accounts were disabled to a file?
Mike Kline

Ken wrote an excellent blog on this on the scripting guys blog

http://blogs.technet.com/b/heyscriptingguy/archive/2011/11/30/use-powershell-to-find-and-remove-inactive-active-directory-users.aspx

note he is using lastlogontimestamp which as he said is accurate between 9-14 days.  I really like that he set the description so you can easily query for that field.

thanks

Mike
Experts Exchange has (a) saved my job multiple times, (b) saved me hours, days, and even weeks of work, and often (c) makes me look like a superhero! This place is MAGIC!
Walt Forbes
Raheman M. Abdul

check this first to test if you are fine with the list:
get-aduser -SearchBase $searchOU -filter * -properties lastlogondate | Where-Object {$_.enabled -eq "true"-and $_.lastlogondate -lt (get-date).adddays(-30)} | out-file c:\disabledaccounts.txt
Raheman M. Abdul

$searchOU=“OU=Accounts,OU=RootOU,DC=ChildDomain,DC=RootDomain,DC=com"

$results = get-aduser -SearchBase $searchOU -filter * -properties lastlogondate | Where-Object {$_.enabled -eq "true"-and $_.lastlogondate -lt (get-date).adddays(-30)} | Set-Aduser -enabled $false

$results | out-file c:\disabledaccounts.txt
cmatchett

ASKER
then if i would like to append a date to the end of the text file?  

i.e. disableduaccounts-01-04-2014.txt

That will allow me to keep an archive
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.
Raheman M. Abdul

$date=get-date -Format "dd-mm-yyyy"

$results | out-file "C:\temp\rahmdel-$date.txt"
cmatchett

ASKER
It disables the users, creates the text file but doesn't append the users who were disabled
Raheman M. Abdul

what does $results show?
This is the best money I have ever spent. I cannot not tell you how many times these folks have saved my bacon. I learn so much from the contributors.
rwheeler23
cmatchett

ASKER
Blank.  i removed '| out-file "C:\temp\rahmdel-$date.txt"' from the powershell
SOLUTION
Raheman M. Abdul

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question
Justin Yeung

 get-aduser -SearchBase $searchOU -filter * -properties lastlogondate | Where-Object {$_.enabled -eq "true"-and $_.lastlogondate -lt (get-date).adddays(-30)} 

Open in new window


if you run then and nothing return, your $result will be $null
cmatchett

ASKER
@ rah this works.  what about updating the description with says "account disabled on" [date]
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.
SOLUTION
Log in to continue reading
Log In
Sign up - Free for 7 days
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.
cmatchett

ASKER
very good.  what if i wanted to search say three different OUs
Justin Yeung

$ou1 = "ou=x,dc=x,dc=x,dc=x"
$ou2 = "ou=xx,dc=x,dc=x,dc=x"
$ou3 = "ou=xxx,dc=x,dc=x,dc=x"

$SearchOUs = $ou1,$ou2,$ou3
foreach ($SearchOU in $OUs)
{
$results = get-aduser -SearchBase $searchOU -filter * -properties lastlogondate | Where-Object {$_.enabled -eq "true"-and $_.lastlogondate -lt (get-date).adddays(-30)} | Set-Aduser -enabled $false

$results | out-file c:\disabledaccounts.txt -append
}
ASKER CERTIFIED SOLUTION
Log in to continue reading
Log In
Sign up - Free for 7 days
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.
andrewcamary

Meanwhile, the DS Query command will also be a nice approach to accomplish this task for what you are looking. Please checkout given link : http://social.technet.microsoft.com/wiki/contents/articles/2195.active-directory-dsquery-commands.aspx
All of life is about relationships, and EE has made a viirtual community a real community. It lifts everyone's boat
William Peck
cmatchett

ASKER
very good