Batch script to move disabled user accounts to different OU

Hey Experts.  I thought I would test my batch skills with a small maintenance project and realized I probably need a little help.  I wanted to modify an existing script that I use for computer accounts but I'm not getting anywhere.

That scripts looks through our domain, finds user accounts that haven't been used for x amount of weeks, disables them and moves them to a different OU.  Each user account and step is echoed out to a log file so I can review it if a user account gets snagged.  

Here's the script I was trying to modify (the one for computer accounts).
@echo off

set computers_log=c:\tools\logs\%date:~4,2%-%date:~7,2%-%date:~10%_dsquery.log
set pc_cleanup_log=c:\tools\logs\%date:~4,2%-%date:~7,2%-%date:~10%_cleanup.log

dsquery computer -o rdn -limit 0 -inactive 4 ou=A,ou=B,dc=C,dc=D,dc=E,dc=F >%computers_log%

echo "Finished dsquery" >>%pc_cleanup_log%

FOR /f "delims= " %%i in (%computers_log%) do ( 
echo disabling %%i && echo. && dsquery computer -name ""%%i"" | dsmod computer -disabled Yes && echo.
)  >>%pc_cleanup_log%


echo "Finished dsmod" >>%pc_cleanup_log%


FOR /f "delims= " %%i in (%computers_log%) do ( 
echo Moving %%i && echo. && dsquery computer -name ""%%i"" | dsmove -newparent "ou=inactive,ou=A,dc=B,dc=C,dc=D,dc=E" && echo.
)  >>%pc_cleanup_log%

:eof

Open in new window


How can I modify that script to use it for user accounts?  Thanks for your help.
LVL 9
samiam41Asked:
Who is Participating?
 
oBdACommented:
Can't test it at the moment, but it should work like this:
@echo off
setlocal

set users_log=c:\tools\logs\%date:~4,2%-%date:~7,2%-%date:~10%_dsquery.log
set user_cleanup_log=c:\tools\logs\%date:~4,2%-%date:~7,2%-%date:~10%_cleanup.log

dsquery user -o samid -limit 0 -inactive 4 ou=A,ou=B,dc=C,dc=D,dc=E,dc=F >%users_log%

echo "Finished dsquery" >>%user_cleanup_log%

FOR /f "delims= " %%i in (%users_log%) do ( 
	echo disabling %%i && echo. && dsquery user -samid %%i | dsmod user -disabled Yes && echo.
)  >>%user_cleanup_log%

echo "Finished dsmod" >>%user_cleanup_log%

FOR /f "delims= " %%i in (%users_log%) do ( 
	echo Moving %%i && echo. && dsquery user -samid %%i | dsmove -newparent "ou=inactive,ou=A,dc=B,dc=C,dc=D,dc=E" && echo.
)  >>%user_cleanup_log%

Open in new window

0
 
Spike99On-Site IT TechnicianCommented:
It would be easier to do using PowerShell, I think.

Here's an example I found online:
import-module activedirectory
# To move the users 
Search-ADAccount –AccountDisabled –UsersOnly –SearchBase “OU=Branch Offices, DC=Company,DC=LAN”  | Move-ADObject –TargetPath “OU=Disabled Users, DC=Company,DC=LAN”

Open in new window


http://jeffwouters.nl/index.php/2012/06/move-disabled-user-accounts-from-protected-ou-with-a-powershell-oneliner/

I also found another example by another Expert here on EE:
import-module activedirectory
$TargetOU = "ou=disabledAccounts,dc=domain,dc=com"
$DisabledAccounts = get-aduser -filter { enabled -eq $false }
ForEach ($account in $DisabledAccounts) {Move-ADObject -Identity $account.distinguishedName -TargetPath $TargetOU}

Open in new window


The link to that EE solution:
https://www.experts-exchange.com/questions/28669932/Automated-Script-to-Move-Disabled-Active-Directory-Accounts.html
1
 
samiam41Author Commented:
I appreciate the reply.  I'd like to use PS but I haven't done much with it and I'm not sure right now is the best time to dive into it.
0
 
samiam41Author Commented:
Testing today.  I was out of the office unexpectedly Friday.
0
 
samiam41Author Commented:
solid solution!!  you are a rockstar!
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.