Advertisement
Guest User

disable ADusers/computers after X time inactive

a guest
Jul 10th, 2018
79
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. I wrote this, wich we use atm
  2.  
  3.     #Logfile Path
  4.     $logpath = 'fil in directory path'
  5.     $logfile = New-Object System.Collections.Generic.List[Psobject]
  6.  
  7.     #Set lastlogon filter, months from current date
  8.     $Months = -12
  9.    
  10.     #SamaAccountNames to excluded from beeing disabled
  11.     $ExcludedUsers = @(
  12.       "user1"
  13.     , "user2"
  14.     )
  15.    
  16.     #Get all AD-Users and AD-Computers
  17.     $OUs = @(
  18.          "OU=users,DC=test,DC=com"
  19.     ,    "OU=computers,DC=test,DC=com"
  20.     )
  21.    
  22.     #Get Users and Computers from specified OU's
  23.     $AdUsers = $OUs | foreach {Get-ADUser -Filter * -SearchScope Subtree -Properties * -SearchBase $_}
  24.     $AdComputers = $OUs | foreach {Get-ADComputer -Filter * -SearchScope Subtree -Properties * -SearchBase $_}
  25.    
  26.     #Filter - to get inactive objects (inactive for more than 12 monts but ACTIVE)
  27.     $AdUsers = $AdUsers | where {$_.LastLogonDate -lt (Get-Date).AddMonths($Months) -and $_.Enabled -eq $true}
  28.     $AdComputers = $AdComputers | where {$_.LastLogonDate -lt (Get-Date).AddMonths($Months) -and $_.Enabled -eq $true}
  29.    
  30.     #Create List With Inactive Users
  31.     $InActiveUsers = New-Object System.Collections.Generic.List[Microsoft.ActiveDirectory.Management.ADAccount]
  32.     foreach ($user in $AdUsers)
  33.     {
  34.         if($user.LastLogonDate -ne $null -and $ExcludedUsers -notcontains $user.SamAccountName)
  35.         {
  36.             $InActiveUsers.Add($user)
  37.         }
  38.     }
  39.    
  40.     #Create List With Inactive Computers
  41.     $InActiveComputers = New-Object System.Collections.Generic.List[Microsoft.ActiveDirectory.Management.ADAccount]
  42.     foreach ($Computer in $AdComputers)
  43.     {
  44.         if($Computer.LastLogonDate -ne $null)
  45.         {
  46.             $InActiveComputers.Add($Computer)
  47.         }
  48.     }
  49.    
  50.     # Deactivating and moving AD Objects
  51.     foreach ($user in $InActiveUsers)
  52.     {
  53.         $user | Disable-ADAccount -Confirm:$false
  54.         #Fill in your own path
  55.         $user | Move-ADObject -TargetPath "OU=Disabled Users,OU=Disabled Items,DC=test,DC=com"
  56.    
  57.         #Create Logfile Object and add to Logfile
  58.         $hash = @{
  59.         'Disabled Date' = (Get-Date).ToString("yyyy-MM-dd hh:MM:ss")
  60.         'LastLogonDate' = $user.LastLogonDate
  61.         'SamaAccountName' = $user.SamAccountName
  62.         'Name' = $user.Name
  63.         'Type' = 'User'
  64.         }
  65.         $obj = New-Object -TypeName Psobject -Property $hash
  66.         $logfile.Add($obj)
  67.     }
  68.    
  69.     foreach ($computer in $InActiveComputers)
  70.     {
  71.         $computer | Disable-ADAccount -Confirm:$false
  72.         #Fill in your own path
  73.         $computer | Move-ADObject -TargetPath "OU=Disabled Computers,OU=Disabled Items,DC=test,DC=com"
  74.    
  75.         #Create Logfile Object and add to Logfile
  76.         $hash = @{
  77.         'Disabled Date' = (Get-Date).ToString("yyyy-MM-dd hh:MM:ss")
  78.         'LastLogonDate' = $computer.LastLogonDate
  79.         'SamaAccountName' = $computer.SamAccountName
  80.         'Name' = $computer.Name
  81.         'Type' = 'Computer'
  82.         }
  83.         $obj = New-Object -TypeName Psobject -Property $hash
  84.         $logfile.Add($obj)
  85.     }
  86.    
  87.     $logfile | select 'Disabled Date',LastLogonDate,SamaAccountName,Name,type | Export-Csv -LiteralPath "$logpath\LogADObj.csv" -Delimiter ';' -NoTypeInformation -Append -Force
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement