Solved

Batch script to move disabled user accounts to different OU

Posted on 2016-11-16
5
33 Views
Last Modified: 2016-11-21
Hey Experts.  I thought I would test my batch skills with a small maintenance project and realized I probably need a little help.  I wanted to modify an existing script that I use for computer accounts but I'm not getting anywhere.

That scripts looks through our domain, finds user accounts that haven't been used for x amount of weeks, disables them and moves them to a different OU.  Each user account and step is echoed out to a log file so I can review it if a user account gets snagged.  

Here's the script I was trying to modify (the one for computer accounts).
@echo off

set computers_log=c:\tools\logs\%date:~4,2%-%date:~7,2%-%date:~10%_dsquery.log
set pc_cleanup_log=c:\tools\logs\%date:~4,2%-%date:~7,2%-%date:~10%_cleanup.log

dsquery computer -o rdn -limit 0 -inactive 4 ou=A,ou=B,dc=C,dc=D,dc=E,dc=F >%computers_log%

echo "Finished dsquery" >>%pc_cleanup_log%

FOR /f "delims= " %%i in (%computers_log%) do ( 
echo disabling %%i && echo. && dsquery computer -name ""%%i"" | dsmod computer -disabled Yes && echo.
)  >>%pc_cleanup_log%


echo "Finished dsmod" >>%pc_cleanup_log%


FOR /f "delims= " %%i in (%computers_log%) do ( 
echo Moving %%i && echo. && dsquery computer -name ""%%i"" | dsmove -newparent "ou=inactive,ou=A,dc=B,dc=C,dc=D,dc=E" && echo.
)  >>%pc_cleanup_log%

:eof

Open in new window


How can I modify that script to use it for user accounts?  Thanks for your help.
0
Comment
Question by:samiam41
  • 3
5 Comments
 
LVL 16

Expert Comment

by:Spike99
ID: 41890389
It would be easier to do using PowerShell, I think.

Here's an example I found online:
import-module activedirectory
# To move the users 
Search-ADAccount –AccountDisabled –UsersOnly –SearchBase “OU=Branch Offices, DC=Company,DC=LAN”  | Move-ADObject –TargetPath “OU=Disabled Users, DC=Company,DC=LAN”

Open in new window


http://jeffwouters.nl/index.php/2012/06/move-disabled-user-accounts-from-protected-ou-with-a-powershell-oneliner/

I also found another example by another Expert here on EE:
import-module activedirectory
$TargetOU = "ou=disabledAccounts,dc=domain,dc=com"
$DisabledAccounts = get-aduser -filter { enabled -eq $false }
ForEach ($account in $DisabledAccounts) {Move-ADObject -Identity $account.distinguishedName -TargetPath $TargetOU}

Open in new window


The link to that EE solution:
https://www.experts-exchange.com/questions/28669932/Automated-Script-to-Move-Disabled-Active-Directory-Accounts.html
1
 
LVL 9

Author Comment

by:samiam41
ID: 41890396
I appreciate the reply.  I'd like to use PS but I haven't done much with it and I'm not sure right now is the best time to dive into it.
0
 
LVL 83

Accepted Solution

by:
oBdA earned 500 total points
ID: 41890512
Can't test it at the moment, but it should work like this:
@echo off
setlocal

set users_log=c:\tools\logs\%date:~4,2%-%date:~7,2%-%date:~10%_dsquery.log
set user_cleanup_log=c:\tools\logs\%date:~4,2%-%date:~7,2%-%date:~10%_cleanup.log

dsquery user -o samid -limit 0 -inactive 4 ou=A,ou=B,dc=C,dc=D,dc=E,dc=F >%users_log%

echo "Finished dsquery" >>%user_cleanup_log%

FOR /f "delims= " %%i in (%users_log%) do ( 
	echo disabling %%i && echo. && dsquery user -samid %%i | dsmod user -disabled Yes && echo.
)  >>%user_cleanup_log%

echo "Finished dsmod" >>%user_cleanup_log%

FOR /f "delims= " %%i in (%users_log%) do ( 
	echo Moving %%i && echo. && dsquery user -samid %%i | dsmove -newparent "ou=inactive,ou=A,dc=B,dc=C,dc=D,dc=E" && echo.
)  >>%user_cleanup_log%

Open in new window

0
 
LVL 9

Author Comment

by:samiam41
ID: 41896237
Testing today.  I was out of the office unexpectedly Friday.
0
 
LVL 9

Author Closing Comment

by:samiam41
ID: 41896586
solid solution!!  you are a rockstar!
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

Active Directory replication delay is the cause to many problems.  Here is a super easy script to force Active Directory replication to all sites with by using an elevated PowerShell command prompt, and a tool to verify your changes.
Today, still in the boom of Apple, PC's and products, nearly 50% of the computer users use Windows as graphical operating systems. If you are among those users who love windows, but are grappling to keep the system's hard drive optimized, then you s…
The viewer will learn how to count occurrences of each item in an array.
The viewer will learn how to successfully download and install the SARDU utility on Windows 7, without downloading adware.

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now