Solved

Help with Powershell script finding disabled users accounts in Active Directory.

Posted on 2014-07-22
10
334 Views
Last Modified: 2014-12-26
I need help with the below script.  The script is working as it should, but need to find out how I can filter out enabled users and just show disabled accounts.  Also, want to add search for disabled account in the last 7 days, this would be based on the criteria that it is disabled, and the "whenChanged" attribute in active directory.

Import-Module ActiveDirectory
Get-Aduser -Filter * -Properties * | Select-Object Name,SamAccountName,whenChanged,Enabled,AccountExpirationDate,@{Name="LastLogonTimestamp"; Expression={[DateTime]::FromFileTime($_.lastLogonTimestamp)}},@{Name="Lastlgon"; Expression={[DateTime]::FromFileTime($_.lastlogon)}},LastlogonDate | Export-Csv C:\Export1.csv

Lastly, I like to export the file into a get-date format so it would look something like this "MM_dd_yyyy_HH_mm"

ex.  $date = Get-Date -Format "MM_dd_yyyy_HH_mm"
       $outputfile = "c:\temp\Disabled_Accounts_Report_$date.csv"


How would I be able to incorporate this into the powershell script.
0
Comment
Question by:tools2teach
  • 4
  • 4
10 Comments
 
LVL 4

Expert Comment

by:Philip Portnoy
ID: 40212173
Hello,

just add a "Where-Object" into the pipe.
In your case it's gonna look like:

$filename = "c:\temp\Disabled_Accounts_Report_" + (Get-Date -Format "MM_dd_yyyy_HH_mm").ToString() + ".csv"

Get-Aduser -Filter * -Properties * | Select-Object Name,SamAccountName,whenChanged,Enabled,AccountExpirationDate,@{Name="LastLogonTimestamp"; Expression={[DateTime]::FromFileTime($_.lastLogonTimestamp)}},@{Name="Lastlgon"; Expression={[DateTime]::FromFileTime($_.lastlogon)}},LastlogonDate | Where-Object {$_.Enabled -eq $false} | Export-Csv $filename

Open in new window

0
 

Author Comment

by:tools2teach
ID: 40212202
Perfect!

How do add filter by last 7 days that an account was disabled based on the "whenChanged" attribute in active directory users?
0
 
LVL 4

Accepted Solution

by:
Philip Portnoy earned 500 total points
ID: 40212214
Same thing you just put additional condition into "Where-Object" pipe:

$filename = "c:\temp\Disabled_Accounts_Report_" + (Get-Date -Format "MM_dd_yyyy_HH_mm").ToString() + ".csv"

Get-Aduser -Filter * -Properties * | Select-Object Name,SamAccountName,whenChanged,Enabled,AccountExpirationDate,@{Name="LastLogonTimestamp"; Expression={[DateTime]::FromFileTime($_.lastLogonTimestamp)}},@{Name="Lastlgon"; Expression={[DateTime]::FromFileTime($_.lastlogon)}},LastlogonDate | Where-Object {$_.Enabled -eq $false -AND $_.WhenChanged -ge Get-Date.AddDays(-7)} | Export-Csv $filename

Open in new window


If you want to get accounts that where change happened more than 7 days ago, just change -ge to -le.
0
 

Author Comment

by:tools2teach
ID: 40212225
Thanks, but I'm getting the following error when trying to run it
Get-Aduser -Filter * -Properties * | Select-Object Name,SamAccountName,whenChanged,Enabled,AccountExpirationDate,@{Name="LastLogonTimestamp"; Expression={[DateTime]::FromFileTime($_.lastLogonTimestamp)}},@{Name="Lastlgon"; Expression={[DateTime]::FromFileTime($_.lastlogon)}},LastlogonDate | Where-Object {$_.Enabled -eq $false -AND $_.WhenChanged -ge Get-Date.AddDays(-7)} | Export-Csv $filename
At line:3 char:352
+ ... WhenChanged -ge Get-Date.AddDays(-7)} | Export-Csv $filename
+                    ~
You must provide a value expression on the right-hand side of the '-ge' operator.
At line:3 char:353
+ ... henChanged -ge Get-Date.AddDays(-7)} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
Unexpected token 'Get-Date.AddDays' in expression or statement.
    + CategoryInfo          : ParserError: (:) [], ParentContainsErrorRecordException
    + FullyQualifiedErrorId : ExpectedValueExpression
0
VMware Disaster Recovery and Data Protection

In this expert guide, you’ll learn about the components of a Modern Data Center. You will use cases for the value-added capabilities of Veeam®, including combining backup and replication for VMware disaster recovery and using replication for data center migration.

 
LVL 4

Expert Comment

by:Philip Portnoy
ID: 40212230
Just try including whole condition into ().
Like this: -ge (Get-Date.AddDays(-7))
0
 

Author Comment

by:tools2teach
ID: 40212250
I'm getting no dice on this one.  Get the following error with the modified commands
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
0
 
LVL 4

Assisted Solution

by:Philip Portnoy
Philip Portnoy earned 500 total points
ID: 40212265
I'm sorry, that's the right syntax for you (I don't have access to PowerShell now so didn't have a chance to check):

((Get-Date).AddDays(-7))
0
 

Author Comment

by:tools2teach
ID: 40212276
Thanks man!  That worked.
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Disabling the Directory Sync Service Account in Office 365 will stop directory synchronization from working.
A brief introduction to what I consider to be the best editor for PowerShell.
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…

910 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

21 Experts available now in Live!

Get 1:1 Help Now