?
Solved

Inactive Users

Posted on 2014-10-30
9
Medium Priority
?
111 Views
Last Modified: 2014-11-09
Dear Experts,

In my organization Windows server 2012 is installed & also AD configured . I want to know which all users are inactive for 90 days. So that those accounts gets disabled automatically & moves to different OU. Is it possible through GP .

Please help as i am new to servers.

Regards,

JCT
0
Comment
Question by:jct_777
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 4
9 Comments
 
LVL 29

Expert Comment

by:becraig
ID: 40414307
Here is a previously answered question which will get you on the right path:

http://www.experts-exchange.com/Software/Server_Software/Active_Directory/Q_24890316.html
0
 
LVL 1

Author Comment

by:jct_777
ID: 40418978
Hi ,

Is there any script which will perform the above requirement. Also i want to exclude those service accounts .

Regards,

JCT
0
 
LVL 29

Expert Comment

by:becraig
ID: 40419701
Here is a question I answered with a script that does the delete, simply change the date/time window you need.
http://www.experts-exchange.com/Programming/Languages/Scripting/Powershell/Q_28506778.html


For disabled users:
$time = (Get-Date).Adddays(-(105))
$delreport = @()
#first step Removing all disabled users not logged in for more than 195 days 
Get-ADuser -filter * | where {$_.Enabled -eq $false -and $_.Name -notlike "SVC_*" -and $_.LastLogonTimeStamp -lt $time} | % {
$user = $_.Name
$grps = ($_.memberof | Get-ADGroup | Select -ExpandProperty Name)
#Remove users from groups
$grps | % {
            Remove-ADGroupMember -Identity $_ -Member $user -whatif
          }

#Remove user from AD
Remove-AdUser -Identity $user -whatif

#create csv report
$item = New-Object PSObject
$item | Add-Member -type NoteProperty -Name 'FNAME' -Value $_.GivenName
$item | Add-Member -type NoteProperty -Name 'LNAME' -Value $_.Surname
$item | Add-Member -type NoteProperty -Name 'USERNAME' -Value $_.samaccountname
$item | Add-Member -type NoteProperty -Name 'USERSID' -Value $_.SID
$delreport += $item
}

$delreport | export-csv report.csv -nti

                        

Open in new window

                       
                 

For removing accounts not disabled but not logged on for more than 90 days:

$time = (Get-Date).Adddays(-(105))
$delreport = @()
#first step Removing all disabled users not logged in for more than 105 days 
Get-ADuser -filter * | where {$_.Enabled -eq $true -and $_.Name -notlike "SVC_*" -and $_.LastLogonTimeStamp -lt $time} | % {
$user = $_.Name
Remove-AdUser -Identity $user -whatif

#create csv report
$item = New-Object PSObject
$item | Add-Member -type NoteProperty -Name 'FNAME' -Value $_.GivenName
$item | Add-Member -type NoteProperty -Name 'LNAME' -Value $_.Surname
$item | Add-Member -type NoteProperty -Name 'USERNAME' -Value $_.samaccountname
$item | Add-Member -type NoteProperty -Name 'USERSID' -Value $_.SID
$delreport += $item
}

$delreport | export-csv Enabled-userdelete.csv -nti

Open in new window

                                         

the script assumes your service accounts have a name starting with svc*
0
Get real performance insights from real users

Key features:
- Total Pages Views and Load times
- Top Pages Viewed and Load Times
- Real Time Site Page Build Performance
- Users’ Browser and Platform Performance
- Geographic User Breakdown
- And more

 
LVL 1

Author Comment

by:jct_777
ID: 40423392
Hi ,

I did run the below script .

@echo off
dsquery user -inactive 13 > C:\Inactiveuser.txt
@echo No of Inactive users:
dsquery user -inactive 13 | find "CN=" /c
@echo Disabling users
dsquery user -inactive 13 | dsmod user -disabled Yes
@echo Moving users
for /F "delims=" %%V in (C:\move.txt) do dsmove %%V -newparent "OU=Disabledusers,DC=aa,DC=local"

But after running the above script the the users which were  inactive for 90 days are getting disabled automatically but it is not getting moved to another OU.

Regards,

JCT
0
 
LVL 29

Expert Comment

by:becraig
ID: 40424684
You can do this in powershell:
gc C:\Inactiveuser.txt  | % { Get-Aduser $_ | Move-ADObject -TargetPath 'OU=Disabledusers,DC=aa,DC=local'}

Open in new window

0
 
LVL 1

Author Comment

by:jct_777
ID: 40425519
Hi ,

Just to confirm if i run the above mentioned command in the powershell it will move only the disabled users.

Active users should not be affected. Please confirm

Regards,

JCT
0
 
LVL 29

Assisted Solution

by:becraig
becraig earned 1500 total points
ID: 40425523
It will move only the users in your text file, you can add -whatif so you can verify.

gc C:\Inactiveuser.txt | % { Get-Aduser $_ | Move-ADObject -TargetPath 'OU=Disabledusers,DC=aa,DC=local' -whatif}

Open in new window

0
 
LVL 1

Author Comment

by:jct_777
ID: 40425566
Hi ,

In inactiveuser .txt the users which are not active for 90 days list is there. but here some users are there who never logged in till now. that account also is disabled . I want to move all the disabled users to different OU.

Regards,

JCT
0
 
LVL 29

Accepted Solution

by:
becraig earned 1500 total points
ID: 40426779
You can either run the script for each list or simply put all the users in one text file and then run the script against that file.

The input will come from the text files you already have from the previous scripts.
0

Featured Post

Get 15 Days FREE Full-Featured Trial

Benefit from a mission critical IT monitoring with Monitis Premium or get it FREE for your entry level monitoring needs.
-Over 200,000 users
-More than 300,000 websites monitored
-Used in 197 countries
-Recommended by 98% of users

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Preface Having the need * to contact many different companies with different infrastructures * do remote maintenance in their network required us to implement a more flexible routing solution. As RAS, PPTP, L2TP and VPN Client connections are no…
Many admins will agree: WSUS is is a nice invention but using it on the client side when updating a newly installed computer is still time consuming as you have to do several reboots and furthermore, the procedure of installing updates, rebooting an…
In this video, we discuss why the need for additional vertical screen space has become more important in recent years, namely, due to the transition in the marketplace of 4x3 computer screens to 16x9 and 16x10 screens (so-called widescreen format). …
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question