Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Is there a script to move all disabled AD accounts over to a specified OU?

Posted on 2014-11-21
10
Medium Priority
?
204 Views
Last Modified: 2014-12-12
I have multiple sites/OU and each one have disabled accounts that i would want to automatically move to a different OU. Is there a Powershell script for this?
0
Comment
Question by:CiscoAzn
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 3
  • 2
10 Comments
 
LVL 29

Expert Comment

by:becraig
ID: 40457949
Here is an easy one, includes the creation of the OU in the event you do not yet have the destination OU created:
#Import AD Module
Import-Module ActiveDirectory

#Check for existence of OU and create if not present
[string] $Path = 'OU=StaleComputers,DC=domain,DC=com'
try
{
	if (!([adsi]::Exists("LDAP://$Path")))
	{
		#Create OU since it does not yet exist
		NEW-ADOrganizationalUnit “StaleComputers” –path “DC=domain, DC=com”
	}
	else { Write-Debug "OU Already Exists:  $Path" }
}
catch [Exception]    {
	return $_.Exception.Message
}


#now we proceed to check for computers
Get-ADComputer -Filter { Enabled -eq $false } | Move-ADObject -TargetPath $Path -WhatIf

Open in new window



If you already have the OU then this will work:


 $Path = 'OU=StaleComputers,DC=domain,DC=com'
Get-ADComputer -Filter { Enabled -eq $false } | Move-ADObject -TargetPath $Path -WhatIf

Open in new window


Remove the whatif to actually run.
0
 

Author Comment

by:CiscoAzn
ID: 40458011
What about pointing to a specific OU for the source of all the sites with the disabled accounts and the destination would the $Path. I don't want to run it for the entire domain.
0
 
LVL 29

Accepted Solution

by:
becraig earned 2000 total points
ID: 40458032
$Path = 'OU=StaleComputers,DC=domain,DC=com'
Get-ADComputer -Filter { Enabled -eq $false } -SearchBase "OU=computerOU,OU=Company,DC=domain,DC=com"  | Move-ADObject -TargetPath $Path -WhatIf

Open in new window


For multiple OUs you can either input them directly and pipe into a foreach loop. (similar to your previous question)


$OUs = 'OU=Users1,OU=Company,DC=domain,DC=com','OU=Users2,OU=Company,DC=domain,DC=com','OU=Users3,OU=Company,DC=domain,DC=com'

$OUs | % { Get-ADComputer -Filter { Enabled -eq $false } -SearchBase $_  | Move-ADObject -TargetPath $Path -WhatIf}

Open in new window

0
Are your AD admin tools letting you down?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

 

Author Comment

by:CiscoAzn
ID: 40458167
I did a test and found out why it didn't work. Had to change from ADComputer to ADUser so this works perfectly thanks!
0
 
LVL 29

Expert Comment

by:becraig
ID: 40458183
No prob, yeah I'd actually done this for computers on another question and just copy and pasted.
0
 
LVL 29

Expert Comment

by:becraig
ID: 40460168
Did you need anything else on this question ?

If so let me know and I will be happy to help.
0
 
LVL 1

Expert Comment

by:Satyendra Tiwari
ID: 40468740
Hi Cisco,
You can download the complete script from this given resource and I hope, it will help you to resolve your purpose for moving all disabled AD accounts to specific OU : https://gallery.technet.microsoft.com/scriptcenter/Move-and-disable-inactive-b1cf86c3
0
 
LVL 29

Expert Comment

by:becraig
ID: 40468747
This question was indicated as answered in comment 40458167
0
 
LVL 1

Expert Comment

by:Satyendra Tiwari
ID: 40468754
This question was indicated as answered in comment 40458167

Ok, i did not see that.
0
 

Author Comment

by:CiscoAzn
ID: 40496585
becraig I want to run this as a scheduled task and not able to. Do you have a way to do this? What is the Action that needs to be input to have this working?
0

Featured Post

Get your Disaster Recovery as a Service basics

Disaster Recovery as a Service is one go-to solution that revolutionizes DR planning. Implementing DRaaS could be an efficient process, easily accessible to non-DR experts. Learn about monitoring, testing, executing failovers and failbacks to ensure a "healthy" DR environment.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

After seeing many questions for JRNL_WRAP_ERROR for replication failure, I thought it would be useful to write this article.
How to deal with a specific error when using the Enable-RemoteMailbox cmdlet to create a mailbox in the cloud-based service, for an existing user in an on-premises Active Directory.
This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012. Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …
Suggested Courses

660 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question