Disable Inactive users in AD

A.Elrayes 186 Reputation points
2022-08-28T11:49:23.843+00:00

Hello,

I got a script to get all in active users in AD then disable them and move to another OU

$DaysInactive = ((Get-Date).AddDays(-90)).Date
$InactiveUsers = Get-ADUser -Filter {(LastLogonDate -lt $DaysInactive) -and (enabled -eq $true)} -Properties * | select-object displayName,samaccountname,givenname,surname,LastLogonDate,DistinguishedName,enabled | ? {$_.DistinguishedName -notlike ",CN=Monitoring Mailboxes,"}
$InactiveUsers | Export-Csv C:\InactiveUsers15.csv -NoTypeInformation

foreach ( $User in $InactiveUsers)

{
$OriginalOU= $User.Distinguishedname
$ChangeDiscription = $User.Samaccountname
$User | Disable-ADAccount
$User | MoveADobject - Targetpath "OU=old users"
Set-ADuser $ChangeDiscription ( " DIsabled dueto inactivity - Moved from " + OriginalOU)
}

The bellow error is after run this script for the first time

235516-script-error.jpg

Note that the inactive users are disabled through the script but not moved to the specified OU.

What is the issue in this script ?

Thanks

Windows Server PowerShell
Windows Server PowerShell
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.PowerShell: A family of Microsoft task automation and configuration management frameworks consisting of a command-line shell and associated scripting language.
5,352 questions
0 comments No comments
{count} votes

Accepted answer
  1. Andreas Baumgarten 95,336 Reputation points MVP
    2022-08-28T13:03:59.553+00:00

    Hi @A.Elrayes ,

    Move-AdObject expect a GUID or DN as the -Identity parameter.
    Also you should provide the full DN of the -TargetPath.
    https://learn.microsoft.com/en-us/powershell/module/activedirectory/move-adobject?view=windowsserver2022-ps

    In your script the variable $OriginalOU contains the DN of the user, not the OU of the user. So could try this:

    Move-ADobject -Identity $OriginalOU -Targetpath "OU=old users,OU=xxx,DC=xyz,DC=abc"  
    

    For Set-AdUser you could try this:

    Set-ADuser $ChangeDiscription -Description ("Disabled dueto inactivity - Moved from  $OriginalOU")  
    

    If you are posting scripts please use the Code Sample option (the Icon with 101010). The Q&A editor will remove some characters of scripts if you paste the script as normal text.

    ----------

    (If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

    Regards
    Andreas Baumgarten

    1 person found this answer helpful.

1 additional answer

Sort by: Most helpful
  1. Andreas Baumgarten 95,336 Reputation points MVP
    2022-08-28T14:08:39.597+00:00

    Hi @A.Elrayes ,

    please add this at the beginning of the script:

    $csvPath = "C:\Junk\" # folder of CSV files  
    $csvFilename = "InactiveUsers_$(Get-Date -UFormat "%Y%m%d").csv" # dynamic filename with date  
    

    Modify the with the Export-Csv like this:

    $InactiveUsers | Export-Csv $($csvPath + $csvFilename)  -NoTypeInformation  
    

    ----------

    (If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

    Regards
    Andreas Baumgarten

    1 person found this answer helpful.