Delete users in a OU after days

Matteo Carlini 0

I adapted the script below to my needs.

I can't get the remove users part to work

$Days = 1280
$LastModified = (Get-Date).Adddays(-($Days))
$Users =Get-ADUser -filter {Enabled -eq $False} -SearchBase 'OU=DisabledAccount,DC=adr,DC=it' -properties WhenChanged  |
where {$_.WhenChanged -le (Get-Date).AddDays(-($Days))} | Select-Object @{ Name="Username"; Expression={$_.SamAccountName} }, Name, WhenChanged, DistinguishedName

ForEach ($Item in $Users){
    Remove-ADUser -Identity $Item.DistinguishedName -Confirm:$false
    Out-File -FilePath C:\Scripts\DeletedUsers.txt -Append
    }

MotoX80 33,371 Reputation points

2023-03-20T18:24:21.48+00:00

What error do you? How many users did the query find?

Display the contents of the $users variable before you process it in the foreach loop.

Display the contents of $Item.DistinguishedName before you call the Remove-ADUser.

You are not piping any data to the Out-File cmdlet.

1 answer

Rich Matheisen 46,551 Reputation points

2023-03-20T19:30:45.32+00:00
You aren't writing anything to your log file. And you aren't doing any error checking (or logging). Try this:

$Days = 1280 $LastModified = (Get-Date).Adddays( - ($Days)) $Users = Get-ADUser -Filter { Enabled -eq $False } -SearchBase 'OU=DisabledAccount,DC=adr,DC=it' -Properties WhenChanged | Where-Object { $_.WhenChanged -le (Get-Date).AddDays( - ($Days)) } | Select-Object @{ Name = "Username"; Expression = { $_.SamAccountName } }, Name, WhenChanged, DistinguishedName ForEach ($Item in $Users) { $dn = $Item.DistinguishedName Try{ Remove-ADUser -Identity $Item.DistinguishedName -Confirm:$false -ErrorAction Stop } Catch{ "DN = $dn was *NOT* removed`n`n$_" | Out-File -FilePath C:\Scripts\DeletedUsers.txt -Append } "DN = $DN WAS removed" |Out-File -FilePath C:\Scripts\DeletedUsers.txt -Append }
Please sign in to rate this answer.
Matteo Carlini 0 Reputation points

2023-03-21T09:33:11.3466667+00:00

Hi Rich Matheisen,

Thanks for your answer

I tried the Script but it didn't delete the users with the following error :

CN=Lxxxza Sxxxxxxa,OU=DisabledAccount,DC=xxx,DC=it was NOT removed

The directory service can perform the requested operation only on a leaf object

Matteo Carlini

Rich Matheisen 46,551 Reputation points

2023-03-21T14:36:12.91+00:00

Well, actually it did work! Now you know why it failed.

This can happen if, for example, the user is also using an Exchange mailbox and has one, or more, active sync devices (smart phone, tablet, etc.). That makes the AD user a base object that has one, or more, child objects.

If that's the situation you can use the Remove-ADObject cmdlet with the -Recursive switch instead of the Remove-ADUser cmdlet. If you do, you'll probably have to also add -Confirm:$False to avoid being prompted for approval of the action.

Matteo Carlini 0 Reputation points

2023-03-21T14:47:46.17+00:00

Thanks.

I modified the script as below.

I would like to insert in the log file the date of deletion.

$Days = 850

$LastModified = (Get-Date).Adddays( - ($Days)) $Users = Get-ADUser -Filter { Enabled -eq $False } -SearchBase 'OU=DisabledAccount,DC=xxx,DC=xx' -Properties WhenChanged | Where-Object { $_.WhenChanged -le (Get-Date).AddDays( - ($Days)) } | Select-Object @{ Name = "Username"; Expression = { $_.SamAccountName } }, Name, WhenChanged, DistinguishedName ForEach ($Item in $Users) { $dn = $Item.DistinguishedName Try{ Remove-ADObject -Identity $Item.DistinguishedName -recursive -Confirm:$false -ErrorAction Stop } Catch{ "DN = $dn was *NOT* removed`n`n$_" | Out-File -FilePath C:\Scripts\DeletedUsers.txt -Append } "DN = $DN WAS removed" |Out-File -FilePath C:\Scripts\DeletedUsers.txt -Append }

Rich Matheisen 46,551 Reputation points

2023-03-21T15:07:48.56+00:00

Add $(Get-Date) to the strings you're writing to the log file.

Matteo Carlini 0 Reputation points

2023-03-22T08:19:45.65+00:00

Perfect!

Just one more question.

I would like to insert in the log file in addition to the date also the date of "when changed"

Thanks

Rich Matheisen 46,551 Reputation points

2023-03-22T14:22:30.3166667+00:00

Add $($Item.WhenChanged) to the strings you're writing to the log file.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Delete users in a OU after days

1 answer

Your answer