Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

Batch script to move disabled user accounts to different OU

Posted on 2016-11-16
5
Medium Priority
?
323 Views
Last Modified: 2016-11-21
Hey Experts.  I thought I would test my batch skills with a small maintenance project and realized I probably need a little help.  I wanted to modify an existing script that I use for computer accounts but I'm not getting anywhere.

That scripts looks through our domain, finds user accounts that haven't been used for x amount of weeks, disables them and moves them to a different OU.  Each user account and step is echoed out to a log file so I can review it if a user account gets snagged.  

Here's the script I was trying to modify (the one for computer accounts).
@echo off

set computers_log=c:\tools\logs\%date:~4,2%-%date:~7,2%-%date:~10%_dsquery.log
set pc_cleanup_log=c:\tools\logs\%date:~4,2%-%date:~7,2%-%date:~10%_cleanup.log

dsquery computer -o rdn -limit 0 -inactive 4 ou=A,ou=B,dc=C,dc=D,dc=E,dc=F >%computers_log%

echo "Finished dsquery" >>%pc_cleanup_log%

FOR /f "delims= " %%i in (%computers_log%) do ( 
echo disabling %%i && echo. && dsquery computer -name ""%%i"" | dsmod computer -disabled Yes && echo.
)  >>%pc_cleanup_log%


echo "Finished dsmod" >>%pc_cleanup_log%


FOR /f "delims= " %%i in (%computers_log%) do ( 
echo Moving %%i && echo. && dsquery computer -name ""%%i"" | dsmove -newparent "ou=inactive,ou=A,dc=B,dc=C,dc=D,dc=E" && echo.
)  >>%pc_cleanup_log%

:eof

Open in new window


How can I modify that script to use it for user accounts?  Thanks for your help.
0
Comment
Question by:samiam41
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
5 Comments
 
LVL 17

Expert Comment

by:Spike99
ID: 41890389
It would be easier to do using PowerShell, I think.

Here's an example I found online:
import-module activedirectory
# To move the users 
Search-ADAccount –AccountDisabled –UsersOnly –SearchBase “OU=Branch Offices, DC=Company,DC=LAN”  | Move-ADObject –TargetPath “OU=Disabled Users, DC=Company,DC=LAN”

Open in new window


http://jeffwouters.nl/index.php/2012/06/move-disabled-user-accounts-from-protected-ou-with-a-powershell-oneliner/

I also found another example by another Expert here on EE:
import-module activedirectory
$TargetOU = "ou=disabledAccounts,dc=domain,dc=com"
$DisabledAccounts = get-aduser -filter { enabled -eq $false }
ForEach ($account in $DisabledAccounts) {Move-ADObject -Identity $account.distinguishedName -TargetPath $TargetOU}

Open in new window


The link to that EE solution:
https://www.experts-exchange.com/questions/28669932/Automated-Script-to-Move-Disabled-Active-Directory-Accounts.html
1
 
LVL 9

Author Comment

by:samiam41
ID: 41890396
I appreciate the reply.  I'd like to use PS but I haven't done much with it and I'm not sure right now is the best time to dive into it.
0
 
LVL 85

Accepted Solution

by:
oBdA earned 2000 total points
ID: 41890512
Can't test it at the moment, but it should work like this:
@echo off
setlocal

set users_log=c:\tools\logs\%date:~4,2%-%date:~7,2%-%date:~10%_dsquery.log
set user_cleanup_log=c:\tools\logs\%date:~4,2%-%date:~7,2%-%date:~10%_cleanup.log

dsquery user -o samid -limit 0 -inactive 4 ou=A,ou=B,dc=C,dc=D,dc=E,dc=F >%users_log%

echo "Finished dsquery" >>%user_cleanup_log%

FOR /f "delims= " %%i in (%users_log%) do ( 
	echo disabling %%i && echo. && dsquery user -samid %%i | dsmod user -disabled Yes && echo.
)  >>%user_cleanup_log%

echo "Finished dsmod" >>%user_cleanup_log%

FOR /f "delims= " %%i in (%users_log%) do ( 
	echo Moving %%i && echo. && dsquery user -samid %%i | dsmove -newparent "ou=inactive,ou=A,dc=B,dc=C,dc=D,dc=E" && echo.
)  >>%user_cleanup_log%

Open in new window

0
 
LVL 9

Author Comment

by:samiam41
ID: 41896237
Testing today.  I was out of the office unexpectedly Friday.
0
 
LVL 9

Author Closing Comment

by:samiam41
ID: 41896586
solid solution!!  you are a rockstar!
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The recent Microsoft changes on update philosophy for Windows pre-10 and their impact on existing WSUS implementations.
While working, an annoying popup showing below will come and we cannot cancel or close it form the screen. The error message will come again and again.
This Micro Tutorial will give you basic overview of the control panel section on Windows 7. It will depth in Network and Internet, Hardware and Sound, etc. This will be demonstrated using Windows 7 operating system.
In this seventh video of the Xpdf series, we discuss and demonstrate the PDFfonts utility, which lists all the fonts used in a PDF file. It does this via a command line interface, making it suitable for use in programs, scripts, batch files — any pl…
Suggested Courses

609 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question