Cannot disable user account

Question

Hi
I am trying to write a script to automatically disable active directory account using our SIEM solution. The script is basically net user username /domainname active:no example net user david /testdomain active:no

The user account I setup is part of the Account Operators group within active directory and is part of the local administrators group on the windows server we have our SIEM solution installed. The issue when we try to run the command with that account on any system is says access denied when attempting to disable the account.

How can I provide this service account with access to disable an account which may think it compromised using this script.

Answer 1

Hello @David Boudreau

You can use a different approach by checking user accounts that have not changed their passwords the last six months, and then disabling and removing those accounts from Active Directory.

In Active Directory Module for Windows PowerShell, run the following script to list the user accounts where the password has not changed in the last six months.

$d = [DateTime]::Today.AddDays(-180)

Get-ADUser -Filter '(PasswordLastSet -lt $d) -or (LastLogonTimestamp -lt $d)' -Properties PasswordLastSet,LastLogonTimestamp | ft Name,PasswordLastSet,@{N="LastLogonTimestamp";E={[datetime]::FromFileTime($_.LastLogonTimestamp)}}

Hope this resolves your Query!!

--
--If the reply is helpful, please Upvote and Accept it as an answer--