Solved

Help with Powershell script finding disabled users accounts in Active Directory.

Posted on 2014-07-22
10
342 Views
Last Modified: 2014-12-26
I need help with the below script.  The script is working as it should, but need to find out how I can filter out enabled users and just show disabled accounts.  Also, want to add search for disabled account in the last 7 days, this would be based on the criteria that it is disabled, and the "whenChanged" attribute in active directory.

Import-Module ActiveDirectory
Get-Aduser -Filter * -Properties * | Select-Object Name,SamAccountName,whenChanged,Enabled,AccountExpirationDate,@{Name="LastLogonTimestamp"; Expression={[DateTime]::FromFileTime($_.lastLogonTimestamp)}},@{Name="Lastlgon"; Expression={[DateTime]::FromFileTime($_.lastlogon)}},LastlogonDate | Export-Csv C:\Export1.csv

Lastly, I like to export the file into a get-date format so it would look something like this "MM_dd_yyyy_HH_mm"

ex.  $date = Get-Date -Format "MM_dd_yyyy_HH_mm"
       $outputfile = "c:\temp\Disabled_Accounts_Report_$date.csv"


How would I be able to incorporate this into the powershell script.
0
Comment
Question by:tools2teach
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 4
10 Comments
 
LVL 4

Expert Comment

by:Philip Portnoy
ID: 40212173
Hello,

just add a "Where-Object" into the pipe.
In your case it's gonna look like:

$filename = "c:\temp\Disabled_Accounts_Report_" + (Get-Date -Format "MM_dd_yyyy_HH_mm").ToString() + ".csv"

Get-Aduser -Filter * -Properties * | Select-Object Name,SamAccountName,whenChanged,Enabled,AccountExpirationDate,@{Name="LastLogonTimestamp"; Expression={[DateTime]::FromFileTime($_.lastLogonTimestamp)}},@{Name="Lastlgon"; Expression={[DateTime]::FromFileTime($_.lastlogon)}},LastlogonDate | Where-Object {$_.Enabled -eq $false} | Export-Csv $filename

Open in new window

0
 

Author Comment

by:tools2teach
ID: 40212202
Perfect!

How do add filter by last 7 days that an account was disabled based on the "whenChanged" attribute in active directory users?
0
 
LVL 4

Accepted Solution

by:
Philip Portnoy earned 500 total points
ID: 40212214
Same thing you just put additional condition into "Where-Object" pipe:

$filename = "c:\temp\Disabled_Accounts_Report_" + (Get-Date -Format "MM_dd_yyyy_HH_mm").ToString() + ".csv"

Get-Aduser -Filter * -Properties * | Select-Object Name,SamAccountName,whenChanged,Enabled,AccountExpirationDate,@{Name="LastLogonTimestamp"; Expression={[DateTime]::FromFileTime($_.lastLogonTimestamp)}},@{Name="Lastlgon"; Expression={[DateTime]::FromFileTime($_.lastlogon)}},LastlogonDate | Where-Object {$_.Enabled -eq $false -AND $_.WhenChanged -ge Get-Date.AddDays(-7)} | Export-Csv $filename

Open in new window


If you want to get accounts that where change happened more than 7 days ago, just change -ge to -le.
0
Free eBook: Backup on AWS

Everything you need to know about backup and disaster recovery with AWS, for FREE!

 

Author Comment

by:tools2teach
ID: 40212225
Thanks, but I'm getting the following error when trying to run it
Get-Aduser -Filter * -Properties * | Select-Object Name,SamAccountName,whenChanged,Enabled,AccountExpirationDate,@{Name="LastLogonTimestamp"; Expression={[DateTime]::FromFileTime($_.lastLogonTimestamp)}},@{Name="Lastlgon"; Expression={[DateTime]::FromFileTime($_.lastlogon)}},LastlogonDate | Where-Object {$_.Enabled -eq $false -AND $_.WhenChanged -ge Get-Date.AddDays(-7)} | Export-Csv $filename
At line:3 char:352
+ ... WhenChanged -ge Get-Date.AddDays(-7)} | Export-Csv $filename
+                    ~
You must provide a value expression on the right-hand side of the '-ge' operator.
At line:3 char:353
+ ... henChanged -ge Get-Date.AddDays(-7)} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
Unexpected token 'Get-Date.AddDays' in expression or statement.
    + CategoryInfo          : ParserError: (:) [], ParentContainsErrorRecordException
    + FullyQualifiedErrorId : ExpectedValueExpression
0
 
LVL 4

Expert Comment

by:Philip Portnoy
ID: 40212230
Just try including whole condition into ().
Like this: -ge (Get-Date.AddDays(-7))
0
 

Author Comment

by:tools2teach
ID: 40212250
I'm getting no dice on this one.  Get the following error with the modified commands
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Get-Date.AddDays : The term 'Get-Date.AddDays' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:354
+ ... enChanged -ge (Get-Date.AddDays(-7))} | Export-Csv $filename
+                    ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-Date.AddDays:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
0
 
LVL 4

Assisted Solution

by:Philip Portnoy
Philip Portnoy earned 500 total points
ID: 40212265
I'm sorry, that's the right syntax for you (I don't have access to PowerShell now so didn't have a chance to check):

((Get-Date).AddDays(-7))
0
 

Author Comment

by:tools2teach
ID: 40212276
Thanks man!  That worked.
0

Featured Post

Microsoft Certification Exam 74-409

Veeam® is happy to provide the Microsoft community with a study guide prepared by MVP and MCT, Orin Thomas. This guide will take you through each of the exam objectives, helping you to prepare for and pass the examination.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
View files under D drive on remote PC 2 23
Add Log to powershell Script 14 30
Duplicate SPN entries 1 23
Raising the AD forest\domain functional level 1 12
This article demonstrates probably the easiest way to configure domain-wide tier isolation within Active Directory. If you do not know tier isolation read https://technet.microsoft.com/en-us/windows-server-docs/security/securing-privileged-access/s…
Always backup Domain, SYSVOL etc.using processes according to Microsoft Best Practices. This is meant as a disaster recovery process for small environments that did not implement backup processes and did not run a secondary domain controller that ne…
The viewer will learn how to create and use a small PHP class to apply a watermark to an image. This video shows the viewer the setup for the PHP watermark as well as important coding language. Continue to Part 2 to learn the core code used in creat…
The viewer will learn how to create a basic form using some HTML5 and PHP for later processing. Set up your basic HTML file. Open your form tag and set the method and action attributes.: (CODE) Set up your first few inputs one for the name and …

738 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question