Inactive Users

Dear Experts,

In my organization Windows server 2012 is installed & also AD configured . I want to know which all users are inactive for 90 days. So that those accounts gets disabled automatically & moves to different OU. Is it possible through GP .

Please help as i am new to servers.

Regards,

JCT
LVL 1
jct_777Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

becraigCommented:
Here is a previously answered question which will get you on the right path:

http://www.experts-exchange.com/Software/Server_Software/Active_Directory/Q_24890316.html
0
jct_777Author Commented:
Hi ,

Is there any script which will perform the above requirement. Also i want to exclude those service accounts .

Regards,

JCT
0
becraigCommented:
Here is a question I answered with a script that does the delete, simply change the date/time window you need.
http://www.experts-exchange.com/Programming/Languages/Scripting/Powershell/Q_28506778.html


For disabled users:
$time = (Get-Date).Adddays(-(105))
$delreport = @()
#first step Removing all disabled users not logged in for more than 195 days 
Get-ADuser -filter * | where {$_.Enabled -eq $false -and $_.Name -notlike "SVC_*" -and $_.LastLogonTimeStamp -lt $time} | % {
$user = $_.Name
$grps = ($_.memberof | Get-ADGroup | Select -ExpandProperty Name)
#Remove users from groups
$grps | % {
            Remove-ADGroupMember -Identity $_ -Member $user -whatif
          }

#Remove user from AD
Remove-AdUser -Identity $user -whatif

#create csv report
$item = New-Object PSObject
$item | Add-Member -type NoteProperty -Name 'FNAME' -Value $_.GivenName
$item | Add-Member -type NoteProperty -Name 'LNAME' -Value $_.Surname
$item | Add-Member -type NoteProperty -Name 'USERNAME' -Value $_.samaccountname
$item | Add-Member -type NoteProperty -Name 'USERSID' -Value $_.SID
$delreport += $item
}

$delreport | export-csv report.csv -nti

                        

Open in new window

                       
                 

For removing accounts not disabled but not logged on for more than 90 days:

$time = (Get-Date).Adddays(-(105))
$delreport = @()
#first step Removing all disabled users not logged in for more than 105 days 
Get-ADuser -filter * | where {$_.Enabled -eq $true -and $_.Name -notlike "SVC_*" -and $_.LastLogonTimeStamp -lt $time} | % {
$user = $_.Name
Remove-AdUser -Identity $user -whatif

#create csv report
$item = New-Object PSObject
$item | Add-Member -type NoteProperty -Name 'FNAME' -Value $_.GivenName
$item | Add-Member -type NoteProperty -Name 'LNAME' -Value $_.Surname
$item | Add-Member -type NoteProperty -Name 'USERNAME' -Value $_.samaccountname
$item | Add-Member -type NoteProperty -Name 'USERSID' -Value $_.SID
$delreport += $item
}

$delreport | export-csv Enabled-userdelete.csv -nti

Open in new window

                                         

the script assumes your service accounts have a name starting with svc*
0
Cloud Class® Course: Microsoft Azure 2017

Azure has a changed a lot since it was originally introduce by adding new services and features. Do you know everything you need to about Azure? This course will teach you about the Azure App Service, monitoring and application insights, DevOps, and Team Services.

jct_777Author Commented:
Hi ,

I did run the below script .

@echo off
dsquery user -inactive 13 > C:\Inactiveuser.txt
@echo No of Inactive users:
dsquery user -inactive 13 | find "CN=" /c
@echo Disabling users
dsquery user -inactive 13 | dsmod user -disabled Yes
@echo Moving users
for /F "delims=" %%V in (C:\move.txt) do dsmove %%V -newparent "OU=Disabledusers,DC=aa,DC=local"

But after running the above script the the users which were  inactive for 90 days are getting disabled automatically but it is not getting moved to another OU.

Regards,

JCT
0
becraigCommented:
You can do this in powershell:
gc C:\Inactiveuser.txt  | % { Get-Aduser $_ | Move-ADObject -TargetPath 'OU=Disabledusers,DC=aa,DC=local'}

Open in new window

0
jct_777Author Commented:
Hi ,

Just to confirm if i run the above mentioned command in the powershell it will move only the disabled users.

Active users should not be affected. Please confirm

Regards,

JCT
0
becraigCommented:
It will move only the users in your text file, you can add -whatif so you can verify.

gc C:\Inactiveuser.txt | % { Get-Aduser $_ | Move-ADObject -TargetPath 'OU=Disabledusers,DC=aa,DC=local' -whatif}

Open in new window

0
jct_777Author Commented:
Hi ,

In inactiveuser .txt the users which are not active for 90 days list is there. but here some users are there who never logged in till now. that account also is disabled . I want to move all the disabled users to different OU.

Regards,

JCT
0
becraigCommented:
You can either run the script for each list or simply put all the users in one text file and then run the script against that file.

The input will come from the text files you already have from the previous scripts.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft Legacy OS

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.