Automated Script to Move Disabled Active Directory Accounts

Hello, what's the best way to automate moving disabled user accounts in Active Directory to another OU?

I want to search Active Directory and if disabled users are found, move them to the "Tombstone" OU.

I understand this can be done through the AD Module for Powershell manually, but I want to see if it can be automatically completed on a weekly basis.

Any input is greatly appreciated!

Thanks.
Ja CheAsked:
Who is Participating?
 
Will SzymkowskiSenior Solution ArchitectCommented:
Try the following powershell command...
import-module activedirectory
$TargetOU = "ou=disabledAccounts,dc=domain,dc=com"
$DisabledAccounts = get-aduser -filter { enabled -eq $false }
ForEach ($account in $DisabledAccounts) {
Move-ADObject -Identity $account.distinguishedName -TargetPath $TargetOU
}

Open in new window


The command above will move ALL disabled users into an OU called Disabled Accounts.

Will.
0
 
Gabriel CliftonNet AdminCommented:
One way I do it is through a batch script that can be set in task scheduler.
for /f "Tokens=*" %%s in ('dsquery user "ou=staff,DC=DOMAIN,DC=LOCAL" -disabled -d DOMAIN.LOCAL -limit 0') do DSMOVE %%s -newparent "ou=Inactive Users,DC=DOMAIN,DC=LOCAL"

Open in new window


Not exactly sure this is what you were looking for.
0
 
Ja CheAuthor Commented:
Thanks for the reply guys.

@Will So in my case, do I just update the Disabled Account references to Tombstoned (in my specific case).
0
Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

 
Will SzymkowskiSenior Solution ArchitectCommented:
@Will So in my case, do I just update the Disabled Account references to Tombstoned (in my specific case).

Yeah just change line 2 TargetOU to the actual path of where you want to move the disabled objects.

Will.
0
 
Ja CheAuthor Commented:
Awesome. That worked perfectly. Is there any way to automate that command?
0
 
Will SzymkowskiSenior Solution ArchitectCommented:
You would need to setup a scheduled task and set it to run X number of days.

Glad that it worked for you.

Will.
0
 
Ja CheAuthor Commented:
Ideally, should it be something like a batch file or VBS? Just want to know best practice.

Thanks again!
0
 
Will SzymkowskiSenior Solution ArchitectCommented:
No you can call powershell scripts from the task scheduler without any issues.

Will.
0
 
Ja CheAuthor Commented:
Thank you, Will!!
0
 
Ja CheAuthor Commented:
The script worked from my Windows 7 machine, but when I attempted to run the script as a standalone test on Server 2008 R2 I received the following error:


Move-ADObject : Access is denied
At C:\scripts_new\tombstoned.ps1:5 char:14
+ Move-ADObject <<<<  -Identity $account.distinguishedName -TargetPath $TargetO
U
    + CategoryInfo          : PermissionDenied: (CN=XXXXXX,OU=XXXXXX,DC=XXXXXX,DC=XXXXXX:ADObject) [Move-ADObject], UnauthorizedAccessException
    + FullyQualifiedErrorId : Access is denied,Microsoft.ActiveDirectory.Manag
   ement.Commands.MoveADObject



This shows up for each account it's attempting to move, but most are already in the desired OU. There's one user account I'm working on that does not get moved, even though it's disabled.

I've searched various parts of the error, but had no resolution. I also installed KB2806748, which is supposed to address this issue and no success either.

Any ideas on how to get past the access denied message?

Thanks!
0
 
Khandu ACommented:
Khandu,

You need to configure powershell on w2k8  to run script.

first  powershell run as admin and type the following command.
Set-ExecutionPolicy RemoteSigned
Set-ExecutionPolicy Unrestricted

and try to run command.

good luck!
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.