How do we disable users with expired AD password with exception from AD OU?

Marvin Oco 1 Reputation point
2021-03-05T08:14:53.023+00:00

How do we disable users with expired AD password with exception from AD OU?

We have script below that disables AD users with expired password

Get-ADUser -Filter * -Properties PasswordExpired |
Where-Object PasswordExpired | Disable-ADAccount**

How do we disable users with expired password AD with exception from AD OU?

Thanks

Windows Server PowerShell
Windows Server PowerShell
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.PowerShell: A family of Microsoft task automation and configuration management frameworks consisting of a command-line shell and associated scripting language.
5,387 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Ulv 81 Reputation points
    2021-03-05T08:41:04.277+00:00

    Hi @Marvin Oco

    Just a clarification

    Today you disable AD users with expired passwords, with the script you've shared.

    What you are hoping for is to exclude members of an AD OU so that they are not disabled if their passwords expire? Is my understanding correct?

    If so there are several ways of doing it, the optimal solution depends on where your script runs today, you could set your script to apply to the OUs you want, and not on the ones where you want to exclude it from being run. This can be accomplished over Powershell, or even with a GPO. Ensuring that the link is enabled, enforced or the order of precedence for the GPO setting.

    Best regards,
    Ulv

  2. Ian Xue (Shanghai Wicresoft Co., Ltd.) 30,376 Reputation points Microsoft Vendor
    2021-03-08T07:48:24.037+00:00

    Hi,

    You can do it like below 

    $ou= "OU=testou,DC=contoso,DC=com"  
Get-ADUser -Filter {Enabled -eq $true}  -Properties PasswordExpired | Where-Object {  
    $_.PasswordExpired -and ($_.DistinguishedName -notlike "*,$ou")} | Disable-ADAccount

    Best Regards，
    Ian Xue

    ============================================

    If the Answer is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    0 comments