Automated Script to Move Disabled Active Directory Accounts

Hello, what's the best way to automate moving disabled user accounts in Active Directory to another OU?

I want to search Active Directory and if disabled users are found, move them to the "Tombstone" OU.

I understand this can be done through the AD Module for Powershell manually, but I want to see if it can be automatically completed on a weekly basis.

Any input is greatly appreciated!

Thanks.
Ja CheAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Gabriel CliftonNet AdminCommented:
One way I do it is through a batch script that can be set in task scheduler.
for /f "Tokens=*" %%s in ('dsquery user "ou=staff,DC=DOMAIN,DC=LOCAL" -disabled -d DOMAIN.LOCAL -limit 0') do DSMOVE %%s -newparent "ou=Inactive Users,DC=DOMAIN,DC=LOCAL"

Open in new window


Not exactly sure this is what you were looking for.
0
Will SzymkowskiSenior Solution ArchitectCommented:
Try the following powershell command...
import-module activedirectory
$TargetOU = "ou=disabledAccounts,dc=domain,dc=com"
$DisabledAccounts = get-aduser -filter { enabled -eq $false }
ForEach ($account in $DisabledAccounts) {
Move-ADObject -Identity $account.distinguishedName -TargetPath $TargetOU
}

Open in new window


The command above will move ALL disabled users into an OU called Disabled Accounts.

Will.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Ja CheAuthor Commented:
Thanks for the reply guys.

@Will So in my case, do I just update the Disabled Account references to Tombstoned (in my specific case).
0
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Will SzymkowskiSenior Solution ArchitectCommented:
@Will So in my case, do I just update the Disabled Account references to Tombstoned (in my specific case).

Yeah just change line 2 TargetOU to the actual path of where you want to move the disabled objects.

Will.
0
Ja CheAuthor Commented:
Awesome. That worked perfectly. Is there any way to automate that command?
0
Will SzymkowskiSenior Solution ArchitectCommented:
You would need to setup a scheduled task and set it to run X number of days.

Glad that it worked for you.

Will.
0
Ja CheAuthor Commented:
Ideally, should it be something like a batch file or VBS? Just want to know best practice.

Thanks again!
0
Will SzymkowskiSenior Solution ArchitectCommented:
No you can call powershell scripts from the task scheduler without any issues.

Will.
0
Ja CheAuthor Commented:
Thank you, Will!!
0
Ja CheAuthor Commented:
The script worked from my Windows 7 machine, but when I attempted to run the script as a standalone test on Server 2008 R2 I received the following error:


Move-ADObject : Access is denied
At C:\scripts_new\tombstoned.ps1:5 char:14
+ Move-ADObject <<<<  -Identity $account.distinguishedName -TargetPath $TargetO
U
    + CategoryInfo          : PermissionDenied: (CN=XXXXXX,OU=XXXXXX,DC=XXXXXX,DC=XXXXXX:ADObject) [Move-ADObject], UnauthorizedAccessException
    + FullyQualifiedErrorId : Access is denied,Microsoft.ActiveDirectory.Manag
   ement.Commands.MoveADObject



This shows up for each account it's attempting to move, but most are already in the desired OU. There's one user account I'm working on that does not get moved, even though it's disabled.

I've searched various parts of the error, but had no resolution. I also installed KB2806748, which is supposed to address this issue and no success either.

Any ideas on how to get past the access denied message?

Thanks!
0
Khandu ACommented:
Khandu,

You need to configure powershell on w2k8  to run script.

first  powershell run as admin and type the following command.
Set-ExecutionPolicy RemoteSigned
Set-ExecutionPolicy Unrestricted

and try to run command.

good luck!
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Powershell

From novice to tech pro — start learning today.