Trying to get AD users and disable them in one script

Question

Trying to get AD users and disable them in one script

Daniel Yarmishin 21

Hey (:
I'm new to AD and powershall. I need to get a list (csv) of users who didn't connect X days and then disable their accounts.
For some reason I cant get past it, I made one script that gets the list, another that disables them. On separate they seem to work but when I combine them they wont work.
here are the scripts :

Accepted answer

2 additional answers

Your answer

Answer 1

Thameur-BOURBITA 36,261 Moderator

Hi,

You can use the second script provided in my previous answer or just add a line to export user before the disable like this:

    $Date = (Get-Date).AddDays(-90)

   Get-ADUser -Filter {LastLogonDate -le $Date  }  -Properties LastLogonDate| select Samaccountname,LastLogonDate | Export-csv c:\lastlogon.csv
    Get-ADUser -Filter {LastLogonDate -le $Date  }  -Properties LastLogonDate,lastLogonTimestamp  | Disable-ADAccount

Please don't forget to mark helpful reply as answer

Daniel Yarmishin 21 Reputation points

2022-03-14T11:06:50.29+00:00

Thank you (:

Answer 2

Thameur-BOURBITA 36,261 Moderator

Hi,

You can use one command instead of your method:

$Date = (Get-Date).AddDays(-90)
Get-ADUser -Filter {LastLogonDate -le $Date  }  -Properties LastLogonDate,lastLogonTimestamp  | Disable-ADAccount

You can also use another this script if you want generate a log file to track all modification performed by the script:

$Date = (Get-Date).AddDays(-90)

$logfile = "c:\temp\logfile.log"

$Userlist = Get-ADUser -Filter {LastLogonDate -le $Date  }  -Properties LastLogonDate,lastLogonTimestamp | select -ExpandProperty SamaAccountname

foreach($UserName in $Userlist)

{
try{

get-aduser -identity $userName -ErrorAction Stop | Disable-ADAccount -ErrorAction Stop

add-content -value "$username disabled" -Path $logfile
}

catch{

add-content -value "Error to disable $username : $_" -Path $logfile


}


}

Please don't forget to mark helpful reply as answer

Daniel Yarmishin 21 Reputation points

2022-03-14T10:04:20.217+00:00

Thank you so much ! I will try it.

$Date = (Get-Date).AddDays(-90)
Get-ADUser -Filter {LastLogonDate -le $Date } -Properties LastLogonDate,lastLogonTimestamp | Disable-ADAccount

Could you please help me also to export the users to csv before the disable?
And another question - can I exclude administrator from the list. something like -Filter {name not -eq 'Administrator}, or something simlier.

Answer 3

Anonymous

Hi,

Please post your code using the Code Sample button or the Ctrl+K shortcut.

Do you see any error messages if you run both scripts?

Best Regards,
Ian Xue

Daniel Yarmishin 21 Reputation points

2022-03-14T10:01:41.3+00:00

I don't have the code, its on the server, that's why I posted the pictures.
I get an error on the second script, when I try to disable the users the first one found.

Share via

Trying to get AD users and disable them in one script

2 additional answers

Your answer