Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Help with Powershell script finding disabled users accounts in Active Directory.

Posted on 2014-07-22
10
Medium Priority
?
356 Views
Last Modified: 2014-12-26
I need help with the below script.  The script is working as it should, but need to find out how I can filter out enabled users and just show disabled accounts.  Also, want to add search for disabled account in the last 7 days, this would be based on the criteria that it is disabled, and the "whenChanged" attribute in active directory.

Import-Module ActiveDirectory
Get-Aduser -Filter * -Properties * | Select-Object Name,SamAccountName,whenChanged,Enabled,AccountExpirationDate,@{Name="LastLogonTimestamp"; Expression={[DateTime]::FromFileTime($_.lastLogonTimestamp)}},@{Name="Lastlgon"; Expression={[DateTime]::FromFileTime($_.lastlogon)}},LastlogonDate | Export-Csv C:\Export1.csv

Lastly, I like to export the file into a get-date format so it would look something like this "MM_dd_yyyy_HH_mm"

ex.  $date = Get-Date -Format "MM_dd_yyyy_HH_mm"
       $outputfile = "c:\temp\Disabled_Accounts_Report_$date.csv"


How would I be able to incorporate this into the powershell script.
0
Comment
Question by:tools2teach
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 4
10 Comments
 
LVL 4

Expert Comment

by:Philip Portnoy
ID: 40212173
Hello,

just add a "Where-Object" into the pipe.
In your case it's gonna look like:

$filename = "c:\temp\Disabled_Accounts_Report_" + (Get-Date -Format "MM_dd_yyyy_HH_mm").ToString() + ".csv"

Get-Aduser -Filter * -Properties * | Select-Object Name,SamAccountName,whenChanged,Enabled,AccountExpirationDate,@{Name="LastLogonTimestamp"; Expression={[DateTime]::FromFileTime($_.lastLogonTimestamp)}},@{Name="Lastlgon"; Expression={[DateTime]::FromFileTime($_.lastlogon)}},LastlogonDate | Where-Object {$_.Enabled -eq $false} | Export-Csv $filename

Open in new window

0
 

Author Comment

by:tools2teach
ID: 40212202
Perfect!

How do add filter by last 7 days that an account was disabled based on the "whenChanged" attribute in active directory users?
0
 
LVL 4

Accepted Solution

by:
Philip Portnoy earned 2000 total points
ID: 40212214
Same thing you just put additional condition into "Where-Object" pipe:

$filename = "c:\temp\Disabled_Accounts_Report_" + (Get-Date -Format "MM_dd_yyyy_HH_mm").ToString() + ".csv"

Get-Aduser -Filter * -Properties * | Select-Object Name,SamAccountName,whenChanged,Enabled,AccountExpirationDate,@{Name="LastLogonTimestamp"; Expression={[DateTime]::FromFileTime($_.lastLogonTimestamp)}},@{Name="Lastlgon"; Expression={[DateTime]::FromFileTime($_.lastlogon)}},LastlogonDate | Where-Object {$_.Enabled -eq $false -AND $_.WhenChanged -ge Get-Date.AddDays(-7)} | Export-Csv $filename

Open in new window


If you want to get accounts that where change happened more than 7 days ago, just change -ge to -le.
0
Are You Ready for GDPR?

With the GDPR deadline set for May 25, 2018, many organizations are ill-prepared due to uncertainty about the criteria for compliance. According to a recent WatchGuard survey, a staggering 37% of respondents don't even know if their organization needs to comply with GDPR. Do you?

 

Author Comment

by:tools2teach
ID: 40212225
Thanks, but I'm getting the following error when trying to run it
Get-Aduser -Filter * -Properties * | Select-Object Name,SamAccountName,whenChanged,Enabled,AccountExpirationDate,@{Name="LastLogonTimestamp"; Expression={[DateTime]::FromFileTime($_.lastLogonTimestamp)}},@{Name="Lastlgon"; Expression={[DateTime]::FromFileTime($_.lastlogon)}},LastlogonDate | Where-Object {$_.Enabled -eq $false -AND $_.WhenChanged -ge Get-Date.AddDays(-7)} | Export-Csv $filename
At line:3 char:352
+ ... WhenChanged -ge Get-Date.AddDays(-7)} | Export-Csv $filename
+                    ~
You must provide a value expression on the right-hand side of the '-ge' operator.
At line:3 char:353
+ ... henChanged -ge Get-Date.AddDays(-7)} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
Unexpected token 'Get-Date.AddDays' in expression or statement.
    + CategoryInfo          : ParserError: (:) [], ParentContainsErrorRecordException
    + FullyQualifiedErrorId : ExpectedValueExpression
0
 
LVL 4

Expert Comment

by:Philip Portnoy
ID: 40212230
Just try including whole condition into ().
Like this: -ge (Get-Date.AddDays(-7))
0
 

Author Comment

by:tools2teach
ID: 40212250
I'm getting no dice on this one.  Get the following error with the modified commands
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
0
 
LVL 4

Assisted Solution

by:Philip Portnoy
Philip Portnoy earned 2000 total points
ID: 40212265
I'm sorry, that's the right syntax for you (I don't have access to PowerShell now so didn't have a chance to check):

((Get-Date).AddDays(-7))
0
 

Author Comment

by:tools2teach
ID: 40212276
Thanks man!  That worked.
0

Featured Post

Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Recently we ran in to an issue while running some SQL jobs where we were trying to process the cubes.  We got an error saying failure stating 'NT SERVICE\SQLSERVERAGENT does not have access to Analysis Services. So this is a way to automate that wit…
Here's a look at newsworthy articles and community happenings during the last month.
The viewer will learn how to create and use a small PHP class to apply a watermark to an image. This video shows the viewer the setup for the PHP watermark as well as important coding language. Continue to Part 2 to learn the core code used in creat…
Attackers love to prey on accounts that have privileges. Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …

715 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question