View difference between Paste ID: YgP5ZL7G and EJ0vFc6z

 ####################################################
 #
 # AD account cleanup script
 # Date Created : 9/22/17
 # Author : PowerMonkey500
 #
 ####################################################
 #
 # WARNING: THIS SCRIPT WILL OVERWRITE EXTENSIONATTRIBUTE3 FOR INACTIVE USERS, MAKE SURE YOU ARE NOT USING IT FOR ANYTHING ELSE
 # This script is SLOW because it gets the most accurate last logon possible by comparing results from all DCs. By default the lastlogontimestamp is only replicated every 14 days minus a random percentage of 5.
 #
 ####################################################
 
 #FUNCTION DECLARATIONS
 #===================================================================================
 
 #Logging function - starts transcript and cleans logs older than specified retention date.
 Function Start-Logging{
     param (
         [Parameter(Mandatory=$true)][String]$LogDirectory,
         [Parameter(Mandatory=$true)][String]$LogName,
         [Parameter(Mandatory=$true)][Int]$LogRetentionDays
         )
 
     #Sets screen buffer from 120 width to 500 width. This stops truncation in the log.
     $ErrorActionPreference = 'SilentlyContinue'
     $pshost = get-host
     $pswindow = $pshost.ui.rawui
 
     $newsize = $pswindow.buffersize
     $newsize.height = 3000
     $newsize.width = 500
     $pswindow.buffersize = $newsize
 
     $newsize = $pswindow.windowsize
     $newsize.height = 50
     $newsize.width = 500
     $pswindow.windowsize = $newsize
     $ErrorActionPreference = 'Continue'
 
     #Create log directory if it does not exist already
     If (!(Test-Path $LogDirectory)){mkdir $LogDirectory}
 
     #Starts logging.
     New-Item -ItemType directory -Path $LogDirectory -Force | Out-Null
     $Today = Get-Date -Format M-d-y
     Start-Transcript -Append -Path ($LogDirectory + "\" + $LogName + "." + $Today + ".log") | Out-Null
 
     #Shows proper date in log.
     Write-Output ("Start time: " + (Get-Date))
 
     #Purges log files older than X days
     $RetentionDate = (Get-Date).AddDays(-$LogRetentionDays)
     Get-ChildItem -Path $LogDirectory -Recurse -Force | Where-Object { !$_.PSIsContainer -and $_.CreationTime -lt $RetentionDate } | Remove-Item -Force
 }
 
 ###NOT USED IN SCRIPT, JUST FOR UTILITY WHEN TWEAKING###
 Function Get-ADUserLastLogon ([string]$UserName){
     $dcs = Get-ADDomainController -Filter {Name -like "*"}
       $time = 0
       $dt = 0
         foreach($dc in $dcs) {
         Try
         {
             $user = Get-ADUser -Server $dc -identity $userName -properties LastLogon,LastLogonTimestamp
             if($user.LastLogonTimeStamp -gt $time)
             {
                 $time = $user.LastLogonTimeStamp
             }
             if ($user.LastLogon -gt $time)
             {
                 $time = $user.LastLogon
             }
         }
         Catch {}
     }
     $dt = [DateTime]::FromFileTime($time)
 
     $OutputObj = New-Object -TypeName PSObject
     $OutputObj | Add-Member -MemberType NoteProperty -Name SamAccountName -Value $user.SamAccountName
     $OutputObj | Add-Member -MemberType NoteProperty -Name Enabled -Value $user.Enabled
     $OutputObj | Add-Member -MemberType NoteProperty -Name LastLogon -Value $dt
     $OutputObj | Add-Member -MemberType NoteProperty -Name GivenName -Value $user.GivenName
     $OutputObj | Add-Member -MemberType NoteProperty -Name Surname -Value $user.SurName
     $OutputObj | Add-Member -MemberType NoteProperty -Name Name -Value $user.Name
     $OutputObj | Add-Member -MemberType NoteProperty -Name DistinguishedName -Value $user.DistinguishedNameName
 
     Return $OutputObj
 }
 
 #-----------------------------------
 #Main script
 #-----------------------------------
 #Declarations
 $From = "noreply@email.com"
 $SMTPServer = "server.domain.local"
 $To = @('email1@email.com','email2@email.com') #Array. You can add more than one entry.
 $Subject = "Account Cleanup Report"
 $TryCount = 0 #Leave this at 0.
 $LogDirectory = "C:\Disable-InactiveADAccountsLog" #No trailing slash
 $LogName = "Disable-InactiveADAccountsLog"
 $MaxTryCount = 20 #Amount of times to try for identical DC results before giving up. 30 second retry delay after each failure.
 $UTCSkew = -5 #Accounting for the time zone difference, since some results are given in UTC. Eastern time is UTC-5.
 $ExclusionsGroup = "ServiceAccts" #AD group containing accounts to exclude.
 $DaysThreshold = 30 #Threshold of days of inactivity before disabling the user.
 
 #Start logging
 Start-Logging -logdirectory $LogDirectory -logname $LogName -LogRetentionDays 30
 
 #Get all DCs, add array names to vars array
 $DCnames = @()
 If (!$DCs){$DCs = Get-ADGroupMember 'Domain Controllers'}
 $DCs | % {$DCnames += $_.Name}
 
 #Check that results match from each DC
 While (($ComparisonResults -contains $False -or !$ComparisonResults) -and $TryCount -lt $MaxTryCount){
 #Fetch AD users from each DC, add to named array
     $DCnames | % {
         #Filters / Exclusions.
         Write-Output ("Fetching last logon times from " + $_ + "...")
         New-Variable -Name $_ -Value (Get-ADUser -Filter {Enabled -eq $True} -Server $_ -Properties DistinguishedName,LastLogon,LastLogonTimestamp,whenCreated,Description | Sort SamAccountName) -Force
     }
 
     $ComparisonResults = @()
     ForEach ($i in 0..(($DCnames.Count)-1)){
         If ($i -le (($DCnames.Count)-2)){
             Write-Output ("Comparing results from " + $DCnames[$i] + " and " + $DCnames[$i+1] + "...")
             $NotEqual = Compare-Object (Get-Variable -Name $DCnames[$i]).Value (Get-Variable -Name $DCnames[$i+1]).Value -Property SamAccountName
 
             If (!$NotEqual) {$ComparisonResults += $True}
             Else {$ComparisonResults += $False}
         }
     }
     If ($ComparisonResults -contains $False){
         Write-Warning "One or more DCs returned differing results. This is likely just replication delay. Retrying..."
         $TryCount++
         Start-Sleep 30
     }
 }
 If ($TryCount -lt $MaxTryCount){Write-Output "All DC results are identical!"}
 Else {Throw "Try limit exceeded. Aborting."}
 
 #Get current time for comparison later.
 If (!$StartTime){$StartTime = Get-Date}
 
 #User count so we know how many times to loop.
 $UserCount = (Get-Variable -Name $DCnames[0]).Value.Count
 
 #Create results array of the same size
 $FullResults = @($null) * $UserCount
 
 #Loop through array indexes
 ForEach ($i in 0..($UserCount -1)){
     #Grab user object from each resultant array, make array of each user object
     $UserEntries = @(0) *$DCnames.Count
     ForEach ($o in 0..($DCnames.Count -1)) {
         $UserEntries[$o] = (Get-Variable -Name $DCnames[$o]).Value[$i]
     }
     If (($UserEntries.SamAccountName | Select -Unique).Count -gt 1){Throw "A user mismatch at index $i has occurred. Aborting."}
 
     #Find most recent LastLogon, whenCreated, and LastLogonTimestamp.
     If ($UserEntries.LastLogon){
         [datetime]$LastLogon = [datetime]::FromFileTimeUtc(($UserEntries | Measure-Object -Property LastLogon -Maximum).Maximum)
         [datetime]$TrueLastLogon = $LastLogon
     }
     Else {[datetime]$LastLogon = 0; $TrueLastLogon = 0}
 
     If ($UserEntries.whenCreated){
         [datetime]$whenCreated = $UserEntries[0].whenCreated
     }
     Else {[datetime]$whenCreated = 0}
 
     If ($UserEntries.LastLogonTimestamp){
         [datetime]$LastLogonTimestamp = [datetime]::FromFileTimeUtc(($UserEntries | Measure-Object -Property LastLogonTimestamp -Maximum).Maximum)
     }
     Else {[datetime]$LastLogonTimestamp = 0}
 
     #If LastLogonTimestamp is newer, use that instead of LastLogon.
     If ($LastLogonTimestamp -gt $LastLogon){$TrueLastLogon = $LastLogonTimestamp}
 
     #UTC to EST
     If ($TrueLastLogon -ne 0){$TrueLastLogon = $TrueLastLogon.AddHours($UTCSkew)}
 
     #If TrueLastLogon is older than 20 years (essentially null/zero), set to true zero
     If ((New-TimeSpan -Start $TrueLastLogon -End $StartTime).Days -gt 7300){[string]$TrueLastLogon = $null}
 
     #Calculate days of inactivity.
     If ($TrueLastLogon -ne $null -and $TrueLastLogon -ne ""){$DaysInactive = (New-TimeSpan -Start $TrueLastLogon -End $StartTime).Days}
     Else {$DaysInactive = (New-TimeSpan -Start $whenCreated -End $StartTime).Days}
 
     #Create object for output array
     $OutputObj = New-Object -TypeName PSObject
     $OutputObj | Add-Member -MemberType NoteProperty -Name SamAccountName -Value $UserEntries[0].SamAccountName
     $OutputObj | Add-Member -MemberType NoteProperty -Name Enabled -Value $UserEntries[0].Enabled
     $OutputObj | Add-Member -MemberType NoteProperty -Name LastLogon -Value $TrueLastLogon
     $OutputObj | Add-Member -MemberType NoteProperty -Name whenCreated -Value $whenCreated
     $OutputObj | Add-Member -MemberType NoteProperty -Name DaysInactive -Value $DaysInactive
     $OutputObj | Add-Member -MemberType NoteProperty -Name GivenName -Value $UserEntries[0].GivenName
     $OutputObj | Add-Member -MemberType NoteProperty -Name Surname -Value $UserEntries[0].SurName
     $OutputObj | Add-Member -MemberType NoteProperty -Name Name -Value $UserEntries[0].Name
     $OutputObj | Add-Member -MemberType NoteProperty -Name DistinguishedName -Value $UserEntries[0].DistinguishedName
     $OutputObj | Add-Member -MemberType NoteProperty -Name Description -Value $UserEntries[0].Description
 
     #Append object to output array and output preogress to console.
     $FullResults[$i] = $OutputObj
     $PercentComplete = [math]::Round((($i/$UserCount) * 100),2)
     Write-Output ("User: " + $OutputObj.SamAccountName + " - Last logon: $TrueLastLogon ($DaysInactive day(s) inactivity) - $PercentComplete% complete.")
 }
 
 Write-Output "Getting exclusion group members..."
 $UserExclusions = (Get-ADGroupMember -Identity $ExclusionsGroup).SamAccountName
 
 #Splits "other" and "real" users into two different arrays.
 Write-Output "Filtering users..."
 $RealUsersResults = @()
 $RealUsersResults = $FullResults | Where {$UserExclusions -notcontains $_.SamAccountName}
 
 $OtherUsersResults = @()
 $FullResults = $FullResults | Where {$_ -ne $null}
 
 #For some reason compare-object is not working properly without specifying all properties. Don't know why.
 $OtherUsersResults = Compare-Object $RealUsersResults $FullResults `
 -Property SamAccountName,enabled,lastlogon,whencreated,DaysInactive,givenname,surname,name,distinguishedname,Description | `
 select SamAccountName,enabled,lastlogon,whencreated,DaysInactive,givenname,surname,name,distinguishedname,Description
 
 #Disable accounts with inactivity past days threshold, add to UsersDisabled array for CSV report
 $UsersDisabled = @()
 $RealUsersResults | % {
     If ($_.DaysInactive -ge $DaysThreshold){
         Write-Output ("Disabling " + $_.SamAccountName + "...")
         Disable-ADAccount -Identity $_.SamAccountName
         $Date = "INACTIVE SINCE " + $_.LastLogon
         Set-ADUser -Identity $_.SamAccountName -Replace @{ExtensionAttribute3=$Date}
         $UsersDisabled += $_
     }
 }
 
 #Filtered users - add to UsersNotDisabled array for CSV report
 $OtherInactiveUsers = @()
 $OtherUsersResults | % {
     If ($_.DaysInactive -ge $DaysThreshold){
         $OtherInactiveUsers += $_
     }
 }
 
 #Reports "Auto-Disable Exclusions-ENT" members
 $ExcludedUsersReport = $FullResults | Where {$UserExclusions -contains $_.SamAccountName} | Select * -ExcludeProperty Enabled,LastLogon,whenCreated,DaysInactive
 
 #Export CSVs to logging directory
 $UsersDisabledCSV = $LogDirectory + "\InactiveUsers-Disabled.csv"
 $UsersNotDisabledCSV = $LogDirectory + "\InactiveUsers-Excluded.csv"
 $ExcludedUsersReportCSV = $LogDirectory + "\Auto-Disable Exclusions.csv"
 $UsersDisabled | Export-CSV $UsersDisabledCSV -NoTypeInformation -Force
 $OtherInactiveUsers | Export-CSV $UsersNotDisabledCSV -NoTypeInformation -Force
 $ExcludedUsersReport | Export-CSV $ExcludedUsersReportCSV -NoTypeInformation -Force
 
 <#
 Write-Output "Starting Move-Disabled task..."
 Start-ScheduledTask -TaskName "\Move-Disabled"
 #>
 
 #Send email with CSVs as attachments
 Write-Output "Sending email..."
 Send-MailMessage -Attachments @($UsersDisabledCSV,$UsersNotDisabledCSV,$ExcludedUsersReportCSV)`
  -From $From -SmtpServer $SMTPServer -To $To -Subject $Subject
 
 Stop-Transcript