Disable Inactive users in AD

Question

Hello,

I got a script to get all in active users in AD then disable them and move to another OU

$DaysInactive = ((Get-Date).AddDays(-90)).Date
$InactiveUsers = Get-ADUser -Filter {(LastLogonDate -lt $DaysInactive) -and (enabled -eq $true)} -Properties * | select-object displayName,samaccountname,givenname,surname,LastLogonDate,DistinguishedName,enabled | ? {$_.DistinguishedName -notlike ",CN=Monitoring Mailboxes,"}
$InactiveUsers | Export-Csv C:\InactiveUsers15.csv -NoTypeInformation

foreach ( $User in $InactiveUsers)

{
$OriginalOU= $User.Distinguishedname
$ChangeDiscription = $User.Samaccountname
$User | Disable-ADAccount
$User | MoveADobject - Targetpath "OU=old users"
Set-ADuser $ChangeDiscription ( " DIsabled dueto inactivity - Moved from " + OriginalOU)
}

The bellow error is after run this script for the first time

Note that the inactive users are disabled through the script but not moved to the specified OU.

What is the issue in this script ?

Thanks

Answer 1

Hi @A.Elrayes ,

Move-AdObject expect a GUID or DN as the -Identity parameter.
Also you should provide the full DN of the -TargetPath.
https://learn.microsoft.com/en-us/powershell/module/activedirectory/move-adobject?view=windowsserver2022-ps

In your script the variable $OriginalOU contains the DN of the user, not the OU of the user. So could try this:

Move-ADobject -Identity $OriginalOU -Targetpath "OU=old users,OU=xxx,DC=xyz,DC=abc"  

For Set-AdUser you could try this:

Set-ADuser $ChangeDiscription -Description ("Disabled dueto inactivity - Moved from  $OriginalOU")  

If you are posting scripts please use the Code Sample option (the Icon with 101010). The Q&A editor will remove some characters of scripts if you paste the script as normal text.

----------

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards
Andreas Baumgarten

Answer 2

Hi @A.Elrayes ,

please add this at the beginning of the script:

$csvPath = "C:\Junk\" # folder of CSV files  
$csvFilename = "InactiveUsers_$(Get-Date -UFormat "%Y%m%d").csv" # dynamic filename with date  

Modify the with the Export-Csv like this:

$InactiveUsers | Export-Csv $($csvPath + $csvFilename)  -NoTypeInformation  

----------

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards
Andreas Baumgarten