GPO TO DISABLE INACTIVE ACCOUNTS IN AD 2008

I need to remove users and computers account that has not logged in to the network in the past 30 days (AD Cleanup). I want to create new OUs as "Disabled Users" and "Disabled Computers" and move these accounts to its corresponding container using a GPO. Can anyone please tell me how to accomplish this? Your feedback will be greatly appreciated.
Hunter24Office 365 Support EngineerAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Neil RussellTechnical Development LeadCommented:
In a word, you cant. A GPO wont manage ad in that respect.  Your best bet would be a powershell script run in task manager on a daily/weekly basis.
0
becraigCommented:
Your best solution here would be to run a daily script to do this, there are lots of examples and ways to get there:

http://www.experts-exchange.com/Software/Server_Software/Active_Directory/Q_24890316.html
0
Hunter24Office 365 Support EngineerAuthor Commented:
Thank you for your fast response in this issue. However,  I still need you to clarify my doubts,  does that mean that I can create the OUs and the script will move the objects  to it? Can these OUs be created within the Users and computers Containers or should be created somewhere else? Can this script or any other be modified to automatically delete this objects after a certain amount of time assuming that they are in the Disabled container?
0
Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

Neil RussellTechnical Development LeadCommented:
Containers should not be used to hold your USERS and COMPUTER objects!  They can not, for one thing, have group policies applied to them.

We do exactly what you are asking but I am not in the office with access to all of the scripts right now.

We extract users who have not logged in for xx days and disable the accounts, move them to a root/DISABLED/USERS OU.
After a further xxx days, users in that OU are then deleted.

We also remove users from ALL groups as they are disabled, email the line manager and change the password to a random one incase the account is re-enabled.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Neil RussellTechnical Development LeadCommented:
I can post an article tomorrow detailing exactly how its all done, with the scripts, if you  dont have a full answer by then.
0
becraigCommented:
You can open a question to have a script created to do all you need.

From what you are saying I am guessing it would work as below.

1. Check for the destination OU if not present create it
2. Check for the users who meet the criteria if found move to that OU
3. Check users in the destination OU and if more than x days then delete.

You can create the OU anywhere you need to.
Yes the script will move the objects once found based on the logic above.
Yes the script can be created to delete objects in the disabled OU after x days.
0
Hunter24Office 365 Support EngineerAuthor Commented:
Hi Neilsr
 If you have that article please post it here, it should be a very helpful guide in this process. Please note that Users and Computers ARE NOT  in the same OU as you explained. Under the domain tree there is a separate OU for each.

Hi becraig:

You got it! Points 1-3 in your answer is exactly what I need! Should I open a SEPARATE question for this script?Please advise. Thanks.
0
becraigCommented:
I would suggest that, in the powershell zone.

Though I can write it pretty quickly there are a lot of other experts who can contribute and get you the most efficient path.
0
Hunter24Office 365 Support EngineerAuthor Commented:
becraig:

I followed your recommendation and have just opened a new question in the powershell zone.
0
becraigCommented:
Great I'll take a look, I'm sure one of the guys might have already provided a solution by now.
0
Hunter24Office 365 Support EngineerAuthor Commented:
Thanks to both for your support, I'm using the AD Tidy app, it has helped me a lot.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2008

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.