asked on

Automated Script to Move Disabled Active Directory Accounts

Hello, what's the best way to automate moving disabled user accounts in Active Directory to another OU?

I want to search Active Directory and if disabled users are found, move them to the "Tombstone" OU.

I understand this can be done through the AD Module for Powershell manually, but I want to see if it can be automatically completed on a weekly basis.

Any input is greatly appreciated!

Thanks.

Gabriel Clifton

One way I do it is through a batch script that can be set in task scheduler.

for /f "Tokens=*" %%s in ('dsquery user "ou=staff,DC=DOMAIN,DC=LOCAL" -disabled -d DOMAIN.LOCAL -limit 0') do DSMOVE %%s -newparent "ou=Inactive Users,DC=DOMAIN,DC=LOCAL"

Open in new window

Not exactly sure this is what you were looking for.

ASKER CERTIFIED SOLUTION

Will Szymkowski

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

Ja Che

ASKER

Thanks for the reply guys.

@Will So in my case, do I just update the Disabled Account references to Tombstoned (in my specific case).

SOLUTION

Marwan Osman

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

Will Szymkowski

@Will So in my case, do I just update the Disabled Account references to Tombstoned (in my specific case).

Yeah just change line 2 TargetOU to the actual path of where you want to move the disabled objects.

Will.

Ja Che

ASKER

Awesome. That worked perfectly. Is there any way to automate that command?

Will Szymkowski

You would need to setup a scheduled task and set it to run X number of days.

Glad that it worked for you.

Will.

Ja Che

ASKER

Ideally, should it be something like a batch file or VBS? Just want to know best practice.

Thanks again!

SOLUTION

Will Szymkowski

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

Ja Che

ASKER

Thank you, Will!!

Ja Che

ASKER

The script worked from my Windows 7 machine, but when I attempted to run the script as a standalone test on Server 2008 R2 I received the following error:

Move-ADObject : Access is denied
At C:\scripts_new\tombstoned.ps1:5 char:14
+ Move-ADObject <<<< -Identity $account.distinguishedName -TargetPath $TargetO
U
+ CategoryInfo : PermissionDenied: (CN=XXXXXX,OU=XXXXXX,DC=XXXXXX,DC=XXXXXX:ADObject) [Move-ADObject], UnauthorizedAccessException
+ FullyQualifiedErrorId : Access is denied,Microsoft.ActiveDirectory.Manag
ement.Commands.MoveADObject

This shows up for each account it's attempting to move, but most are already in the desired OU. There's one user account I'm working on that does not get moved, even though it's disabled.

I've searched various parts of the error, but had no resolution. I also installed KB2806748, which is supposed to address this issue and no success either.

Any ideas on how to get past the access denied message?

Thanks!

Khandu A

Khandu,

You need to configure powershell on w2k8 to run script.

first powershell run as admin and type the following command.
Set-ExecutionPolicy RemoteSigned
Set-ExecutionPolicy Unrestricted

and try to run command.

good luck!