Solved

Batch script to move disabled user accounts to different OU

Posted on 2016-11-16
5
75 Views
Last Modified: 2016-11-21
Hey Experts.  I thought I would test my batch skills with a small maintenance project and realized I probably need a little help.  I wanted to modify an existing script that I use for computer accounts but I'm not getting anywhere.

That scripts looks through our domain, finds user accounts that haven't been used for x amount of weeks, disables them and moves them to a different OU.  Each user account and step is echoed out to a log file so I can review it if a user account gets snagged.  

Here's the script I was trying to modify (the one for computer accounts).
@echo off

set computers_log=c:\tools\logs\%date:~4,2%-%date:~7,2%-%date:~10%_dsquery.log
set pc_cleanup_log=c:\tools\logs\%date:~4,2%-%date:~7,2%-%date:~10%_cleanup.log

dsquery computer -o rdn -limit 0 -inactive 4 ou=A,ou=B,dc=C,dc=D,dc=E,dc=F >%computers_log%

echo "Finished dsquery" >>%pc_cleanup_log%

FOR /f "delims= " %%i in (%computers_log%) do ( 
echo disabling %%i && echo. && dsquery computer -name ""%%i"" | dsmod computer -disabled Yes && echo.
)  >>%pc_cleanup_log%


echo "Finished dsmod" >>%pc_cleanup_log%


FOR /f "delims= " %%i in (%computers_log%) do ( 
echo Moving %%i && echo. && dsquery computer -name ""%%i"" | dsmove -newparent "ou=inactive,ou=A,dc=B,dc=C,dc=D,dc=E" && echo.
)  >>%pc_cleanup_log%

:eof

Open in new window


How can I modify that script to use it for user accounts?  Thanks for your help.
0
Comment
Question by:samiam41
  • 3
5 Comments
 
LVL 16

Expert Comment

by:Spike99
ID: 41890389
It would be easier to do using PowerShell, I think.

Here's an example I found online:
import-module activedirectory
# To move the users 
Search-ADAccount –AccountDisabled –UsersOnly –SearchBase “OU=Branch Offices, DC=Company,DC=LAN”  | Move-ADObject –TargetPath “OU=Disabled Users, DC=Company,DC=LAN”

Open in new window


http://jeffwouters.nl/index.php/2012/06/move-disabled-user-accounts-from-protected-ou-with-a-powershell-oneliner/

I also found another example by another Expert here on EE:
import-module activedirectory
$TargetOU = "ou=disabledAccounts,dc=domain,dc=com"
$DisabledAccounts = get-aduser -filter { enabled -eq $false }
ForEach ($account in $DisabledAccounts) {Move-ADObject -Identity $account.distinguishedName -TargetPath $TargetOU}

Open in new window


The link to that EE solution:
https://www.experts-exchange.com/questions/28669932/Automated-Script-to-Move-Disabled-Active-Directory-Accounts.html
1
 
LVL 9

Author Comment

by:samiam41
ID: 41890396
I appreciate the reply.  I'd like to use PS but I haven't done much with it and I'm not sure right now is the best time to dive into it.
0
 
LVL 83

Accepted Solution

by:
oBdA earned 500 total points
ID: 41890512
Can't test it at the moment, but it should work like this:
@echo off
setlocal

set users_log=c:\tools\logs\%date:~4,2%-%date:~7,2%-%date:~10%_dsquery.log
set user_cleanup_log=c:\tools\logs\%date:~4,2%-%date:~7,2%-%date:~10%_cleanup.log

dsquery user -o samid -limit 0 -inactive 4 ou=A,ou=B,dc=C,dc=D,dc=E,dc=F >%users_log%

echo "Finished dsquery" >>%user_cleanup_log%

FOR /f "delims= " %%i in (%users_log%) do ( 
	echo disabling %%i && echo. && dsquery user -samid %%i | dsmod user -disabled Yes && echo.
)  >>%user_cleanup_log%

echo "Finished dsmod" >>%user_cleanup_log%

FOR /f "delims= " %%i in (%users_log%) do ( 
	echo Moving %%i && echo. && dsquery user -samid %%i | dsmove -newparent "ou=inactive,ou=A,dc=B,dc=C,dc=D,dc=E" && echo.
)  >>%user_cleanup_log%

Open in new window

0
 
LVL 9

Author Comment

by:samiam41
ID: 41896237
Testing today.  I was out of the office unexpectedly Friday.
0
 
LVL 9

Author Closing Comment

by:samiam41
ID: 41896586
solid solution!!  you are a rockstar!
0

Featured Post

Master Your Team's Linux and Cloud Stack!

The average business loses $13.5M per year to ineffective training (per 1,000 employees). Keep ahead of the competition and combine in-person quality with online cost and flexibility by training with Linux Academy.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

When you start your Windows 10 PC and got an "Operating system not found" error or just saw  "Auto repair for startup" or a blinking cursor with black screen. A loop for Auto repair will start but fix nothing.  You will be panic as there are no back…
A quick guide on how to use Group Policy to create a custom power plan and set it active on Windows 7.
This Micro Tutorial will give you a basic overview of Windows DVD Burner through its features and interface. This will be demonstrated using Windows 7 operating system.
The viewer will learn the basics of jQuery, including how to invoke it on a web page. Reference your jQuery libraries: (CODE) Include your new external js/jQuery file: (CODE) Write your first lines of code to setup your site for jQuery.: (CODE)

776 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question