?
Solved

GPO TO DISABLE  INACTIVE ACCOUNTS IN  AD 2008

Posted on 2014-11-18
12
Medium Priority
?
163 Views
Last Modified: 2014-11-25
I need to remove users and computers account that has not logged in to the network in the past 30 days (AD Cleanup). I want to create new OUs as "Disabled Users" and "Disabled Computers" and move these accounts to its corresponding container using a GPO. Can anyone please tell me how to accomplish this? Your feedback will be greatly appreciated.
0
Comment
Question by:Hunter24
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 4
  • 3
12 Comments
 
LVL 37

Assisted Solution

by:Neil Russell
Neil Russell earned 450 total points
ID: 40450471
In a word, you cant. A GPO wont manage ad in that respect.  Your best bet would be a powershell script run in task manager on a daily/weekly basis.
0
 
LVL 29

Assisted Solution

by:becraig
becraig earned 1050 total points
ID: 40450473
Your best solution here would be to run a daily script to do this, there are lots of examples and ways to get there:

http://www.experts-exchange.com/Software/Server_Software/Active_Directory/Q_24890316.html
0
 

Author Comment

by:Hunter24
ID: 40450629
Thank you for your fast response in this issue. However,  I still need you to clarify my doubts,  does that mean that I can create the OUs and the script will move the objects  to it? Can these OUs be created within the Users and computers Containers or should be created somewhere else? Can this script or any other be modified to automatically delete this objects after a certain amount of time assuming that they are in the Disabled container?
0
Does Powershell have you tied up in knots?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 
LVL 37

Accepted Solution

by:
Neil Russell earned 450 total points
ID: 40450635
Containers should not be used to hold your USERS and COMPUTER objects!  They can not, for one thing, have group policies applied to them.

We do exactly what you are asking but I am not in the office with access to all of the scripts right now.

We extract users who have not logged in for xx days and disable the accounts, move them to a root/DISABLED/USERS OU.
After a further xxx days, users in that OU are then deleted.

We also remove users from ALL groups as they are disabled, email the line manager and change the password to a random one incase the account is re-enabled.
0
 
LVL 37

Expert Comment

by:Neil Russell
ID: 40450636
I can post an article tomorrow detailing exactly how its all done, with the scripts, if you  dont have a full answer by then.
0
 
LVL 29

Assisted Solution

by:becraig
becraig earned 1050 total points
ID: 40450637
You can open a question to have a script created to do all you need.

From what you are saying I am guessing it would work as below.

1. Check for the destination OU if not present create it
2. Check for the users who meet the criteria if found move to that OU
3. Check users in the destination OU and if more than x days then delete.

You can create the OU anywhere you need to.
Yes the script will move the objects once found based on the logic above.
Yes the script can be created to delete objects in the disabled OU after x days.
0
 

Author Comment

by:Hunter24
ID: 40452854
Hi Neilsr
 If you have that article please post it here, it should be a very helpful guide in this process. Please note that Users and Computers ARE NOT  in the same OU as you explained. Under the domain tree there is a separate OU for each.

Hi becraig:

You got it! Points 1-3 in your answer is exactly what I need! Should I open a SEPARATE question for this script?Please advise. Thanks.
0
 
LVL 29

Expert Comment

by:becraig
ID: 40452938
I would suggest that, in the powershell zone.

Though I can write it pretty quickly there are a lot of other experts who can contribute and get you the most efficient path.
0
 

Author Comment

by:Hunter24
ID: 40453598
becraig:

I followed your recommendation and have just opened a new question in the powershell zone.
0
 
LVL 29

Expert Comment

by:becraig
ID: 40453738
Great I'll take a look, I'm sure one of the guys might have already provided a solution by now.
0
 

Author Closing Comment

by:Hunter24
ID: 40465518
Thanks to both for your support, I'm using the AD Tidy app, it has helped me a lot.
0

Featured Post

Hire Technology Freelancers with Gigs

Work with freelancers specializing in everything from database administration to programming, who have proven themselves as experts in their field. Hire the best, collaborate easily, pay securely, and get projects done right.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Scenario:  You do full backups to a internal hard drive in either product (SBS or Server 2008).  All goes well for a very long time.  One day, backups begin to fail with a message that the disk is full.  Your disk contains many, many more backups th…
This article provides a convenient collection of links to Microsoft provided Security Patches for operating systems that have reached their End of Life support cycle. Included operating systems covered by this article are Windows XP,  Windows Server…
To efficiently enable the rotation of USB drives for backups, storage pools need to be created. This way no matter which USB drive is installed, the backups will successfully write without any administrative intervention. Multiple USB devices need t…
This tutorial will walk an individual through configuring a drive on a Windows Server 2008 to perform shadow copies in order to quickly recover deleted files and folders. Click on Start and then select Computer to view the available drives on the se…
Suggested Courses

765 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question