inactive-aduser-query

# http://stackoverflow.com/questions/37577369/inactive-aduser-query-and-adgroup-manipulation-encountering-issues

# Import Modules Needed
Import-Module ActiveDirectory

# Output results to CSV file
$LogFile = "C:\ZombieAcct_90dayRpt_n_Move.csv"

# Today's Date
$today = get-date -uformat "%Y/%m/%d"

# Date to search by
$xDays = (get-date).AddDays(-90)

# Expiration date
$expire = (get-date).AddDays(-1)

# Date disabled description variable
$userDesc = "Disabled Inactive" + " - " + $today

# Sets the OU to do the base search for all user accounts, change as required
$SearchBase = "OU=DEFINE,OU=DEFINE,OU=DEFINE,DC=DEFINE,DC=com"

# Sets the OU where accounts will be MOVED TO, change as required
$ParkingOU = "OU=30Days, OU=Disabled Accounts, OU=Domain Services, DC=DEFINE, DC=com"

# Pull all inactive users older than 90-days from a specified OU
$Users = Get-ADUser -SearchBase $SearchBase -Properties memberof, LastLogonDate, PasswordLastSet, PasswordNeverExpires, WhenCreated, DisplayName -Filter {
    (LastLogonDate -notlike '*' -OR LastLogonDate -le $xDays)
    -AND (PasswordLastSet -le $xDays)
    -AND (Enabled -eq $True)
    -AND (PasswordNeverExpires -eq $false)
    -AND (WhenCreated -le $xDays)
} | ForEach-Object {
    Set-ADUser $_ -AccountExpirationDate $expire -Description $userdesc -WhatIf
    Move-ADObject $_ -TargetPath $ParkingOU -WhatIf
    $_ | select DisplayName, Name, SAMaccountName, PasswordExpired, PasswordNeverExpires, WhenCreated, PasswordLastSet, LastLogonDate, @{n='Groups';e={(($_.memberof | Get-ADGroup).Name) -join '; '}}
}

$Users | Export-Csv $LogFile -NoTypeInformation

start $LogFile