View difference between Paste ID: rjpgGwd7 and nPtGPcfV

 ###########################################################
 #
 # AUTHOR  : PowerMonkey500
 #
 # WARNING: THIS SCRIPT WILL OVERWRITE EXTENSIONATTRIBUTE3, MAKE SURE YOU ARE NOT USING IT FOR ANYTHING ELSE
 #
 # Make sure you create the OU structure as detailed in the "declarations" section. This script will not create the OUs for you.
 #
 ###########################################################
 
 #LOGGING FUNCTION - starts transcript and cleans logs older than specified retention date.
 Function Start-Logging{
     param (
         [Parameter(Mandatory=$true)][String]$LogDirectory,
         [Parameter(Mandatory=$true)][String]$LogName,
         [Parameter(Mandatory=$true)][Int]$LogRetentionDays
         )
 
     #Sets screen buffer from 120 width to 500 width. This stops truncation in the log.
     $ErrorActionPreference = 'SilentlyContinue'
     $pshost = get-host
     $pswindow = $pshost.ui.rawui
 
     $newsize = $pswindow.buffersize
     $newsize.height = 3000
     $newsize.width = 500
     $pswindow.buffersize = $newsize
 
     $newsize = $pswindow.windowsize
     $newsize.height = 50
     $newsize.width = 500
     $pswindow.windowsize = $newsize
     $ErrorActionPreference = 'Continue'
 
     #Create log directory if it does not exist already
     If (!(Test-Path $LogDirectory)){mkdir $LogDirectory}
 
     #Starts logging.
     New-Item -ItemType directory -Path $LogDirectory -Force | Out-Null
     $Today = Get-Date -Format M-d-y
     Start-Transcript -Append -Path ($LogDirectory + "\" + $LogName + "." + $Today + ".log") | Out-Null
 
     #Shows proper date in log.
     Write-Output ("Start time: " + (Get-Date))
 
     #Purges log files older than X days
     $RetentionDate = (Get-Date).AddDays(-$LogRetentionDays)
     Get-ChildItem -Path $LogDirectory -Recurse -Force | Where-Object { !$_.PSIsContainer -and $_.CreationTime -lt $RetentionDate } | Remove-Item -Force
 }
 
 #DECLARATIONS
     #Declares misc variables.
     $LogDirectory = "C:\Logs\Disable-InactiveADAccountsLog" #No trailing slash
     $LogName = "Disable-InactiveADAccountsLog"
     $MovedUsers = 0 #Leave at 0.
     $MovedComputers = 0 #Leave at 0.
 
     $ParentOU = "OU=Disabled Objects,DC=domain,DC=local"
 
     #CREATE AN OU STRUCTURE UNDER YOUR PARENT OU AS FOLLOWS:
     #
     # Parent OU (specified above)
     # -> Users
     # --> 0-30 Days
     # --> 30-180 Days
     # --> Over 180 Days
     #
     # -> Computers
     # --> 0-30 Days
     # --> 30-180 Days
     # --> Over 180 Days
 
 #START LOGGING
 Start-Logging -logdirectory $LogDirectory -logname $LogName -LogRetentionDays 30
 
 #MOVE NEWLY DISABLED USERS
     Write-Host ""
     Write-Output "NEWLY DISABLED MOVE:"
     #Gets all newly users. msExchRecipientTypeDetails makes sure we are excluding things like shared mailboxes.
     Write-Output "Getting newly disabled users..."
     $DisabledUsers = Search-ADAccount -AccountDisabled -UsersOnly | Get-ADUser -Properties msExchRecipientTypeDetails,info,Enabled,distinguishedName,ExtensionAttribute3 | Where {@(1,128,65536,2097152,2147483648,$null) -contains $_.msExchRecipientTypeDetails -and $_.DistinguishedName -notlike "*Builtin*"}
 
     Write-Output ($DisabledUsers.Count.toString() + " newly disabled user objects were found.")
 
     #Loops through the newly disabled users found.
     ForEach ($DisabledUser in $DisabledUsers){
         #Moves the user.
         Write-Output ("Moving user: " + $DisabledUser.SamAccountName + "...")
         Move-ADObject -Identity $DisabledUser.DistinguishedName -TargetPath "OU=0-30 Days,OU=Users,$ParentOU"
         $MovedUsers++
 
         #Sets the info (notes) field with the old OU.
         #Formats the new info field (notes). Retains old info if any exists.
         Write-Output ("Setting info field for user: " + $DisabledUser.SamAccountName + "...")
         #Gets the parent OU.
         $OU = $DisabledUser.DistinguishedName.Split(',',2)[1]
         If ($DisabledUser.Info -eq $null -or $DisabledUser.Info -eq ""){$NewInfo = "OLD OU: " + $OU}
         Else{$NewInfo = "OLD OU: " + $OU + "`n" + $DisabledUser.Info}
         Set-ADUser -Identity $DisabledUser.SamAccountName -Replace @{info=$NewInfo}
 
         #Sets ExtensionAttribute3 for the date of disablement if not already set.
         If ($DisabledUser.ExtensionAttribute3 -notlike "*DISABLED*" -and $DisabledUser.ExtensionAttribute3 -notlike "*INACTIVE*"){
             $Date = "DISABLED ON " + (Get-Date)
             Write-Output ("Setting ExtensionAttribute3 for user: " + $DisabledUser.SamAccountName + "...")
             Set-ADUser -Identity $DisabledUser.SamAccountName -Replace @{ExtensionAttribute3=$Date}
         }
     }
 
 #MOVE NEWLY DISABLED COMPUTERS
     #Get disabled computer accounts.
     Write-Output "Getting disabled computers..."
     $DisabledComputers =  Get-ADComputer -Filter * -Properties Enabled,Description,distinguishedName,ExtensionAttribute3 | Where {`
         $_.Enabled -eq $False -and `
         $_.DistinguishedName -notlike "*$ParentOU"
     }
 
     Write-Output ($DisabledComputers.Count.toString() + " newly disabled computer objects were found.")
 
     ForEach ($DisabledComputer in $DisabledComputers){
     #Moves the Computer.
         Write-Output ("Moving computer: " + $DisabledComputer.SamAccountName + "...")
         Move-ADObject -Identity $DisabledComputer.DistinguishedName -TargetPath "OU=0-30 Days,OU=Computers,$ParentOU"
         $MovedComputers++
 
         #Sets the description (notes) field with the old OU.
         #Formats the new description field (notes). Retains old Description if any exists.
         Write-Output ("Setting Description field for computer: " + $DisabledComputer.SamAccountName + "...")
         #Gets the parent OU.
         $OU = $DisabledComputer.DistinguishedName.Split(',',2)[1]
         If ($DisabledComputer.Description -eq $null -or $DisabledComputer.Description -eq ""){$NewDescription = "OLD OU: " + $OU}
         Else{$NewDescription = "OLD OU: " + $OU + " | " + $DisabledComputer.Description}
         Set-ADComputer -Identity $DisabledComputer.SamAccountName -Replace @{Description=$NewDescription}
 
         #Sets ExtensionAttribute3 for the date of disablement if not already set.
         If ($DisabledComputer.ExtensionAttribute3 -notlike "*DISABLED*" -and $DisabledComputer.ExtensionAttribute3 -notlike "*INACTIVE*"){
             $Date = "DISABLED ON " + (Get-Date)
             Write-Output ("Setting ExtensionAttribute3 for computer: " + $DisabledComputer.SamAccountName + "...")
             Set-ADComputer -Identity $DisabledComputer.SamAccountName -Replace @{ExtensionAttribute3=$Date}
         }
     }
 
 #INCREMENT THROUGH OUS BASED ON AGE
     Write-Host ""
     Write-Output "OU INCREMENTATION:"
     #Gets objects in the disabled OU
     $DisabledOUUsers = Get-ADUser -Filter * -SearchBase "$ParentOU" -Properties ExtensionAttribute3,DistinguishedName,SamAccountName
     $DisabledOUComputers = Get-ADComputer -Filter * -SearchBase "$ParentOU" -Properties ExtensionAttribute3,DistinguishedName,SamAccountName
 
     #USERS
         #Declares counts for output.
         $30to180DayMovedUsers = 0
         $180DayMovedUsers = 0
 
         #Loops through users and checks if older than 30 days.
         ForEach ($DisabledOUUser in $DisabledOUUsers){
             #Sets the date disabled if not already set
             If ($DisabledOUUser.ExtensionAttribute3 -eq "" -or $DisabledOUUser.ExtensionAttribute3 -eq $null){
                 Write-Output ("Setting ExtensionAttribute 3 for user: " + $DisabledOUUser.SamAccountName + " (user was in disabled objects OU but did not have a disabled date.)")
 
                 $Date = "DISABLED ON " + (Get-Date)
                 Set-ADUser -Identity $DisabledOUUser.SamAccountName -Replace @{ExtensionAttribute3=$Date}
 
                 #Sets the variable for comparison in the rest of the loop. It was null.
                 $DisabledOUUser.ExtensionAttribute3 = $Date
             }
 
             #Extracts the date disabled for comparison.
             #If disabled by hand, count from the disable date
             If ($DisabledOUUser.ExtensionAttribute3 -like "DISABLED ON*"){
                 $DateDisabled = [datetime]($DisabledOUUser.ExtensionAttribute3.Replace('DISABLED ON ',''))
                 $DaysDisabled = (New-TimeSpan -Start $DateDisabled -End (Get-Date)).Days
             }
             #If auto-disabled because of inactivity, add an extra 30 days to account for that so that we are counting from date disabled rather than last activity date.
             ElseIf ($DisabledOUUser.ExtensionAttribute3 -like "INACTIVE SINCE*"){
                 $DateDisabled = [datetime]($DisabledOUUser.ExtensionAttribute3.Replace('INACTIVE SINCE ',''))
                 $DaysDisabled = (New-TimeSpan -Start $DateDisabled.AddDays(30) -End (Get-Date)).Days
             }
             Else {Write-Error ($DisabledOUUser.SamAccountName + " has an invalid disable date in ExtensionAttribute3.")}
 
             #Increment through OUs
             If ($DaysDisabled -ge 30 -and $DaysDisabled -le 180 -and $DisabledOUUser.DistinguishedName -notlike "*OU=30-180 Days,OU=Users,$ParentOU"){
                 Write-Output ("Moving user to the 30-180 Days OU: " + $DisabledOUUser.SamAccountName)
                 Move-ADObject -Identity $DisabledOUUser.DistinguishedName -TargetPath "OU=30-180 Days,OU=Users,$ParentOU"
                 $30to180DayMovedUsers++
             }
             Else {
                 If ($DaysDisabled -gt 180 -and $DisabledOUUser.DistinguishedName -notlike "*OU=Over 180 Days,OU=Users,$ParentOU"){
                     Write-Output ("Moving user to the Over 180 Days OU: " + $DisabledOUUser.SamAccountName)
                     Move-ADObject -Identity $DisabledOUUser.DistinguishedName -TargetPath "OU=Over 180 Days,OU=Users,$ParentOU"
                     $180DayMovedUsers++
                 }
             }
         }
 
     #COMPUTERS
         #Declares counts for output.
         $30to180DayMovedComputers = 0
         $180DayMovedComputers = 0
 
 
         #Loops through computers and checks if older than 90 days.
         ForEach ($DisabledOUComputer in $DisabledOUComputers){
             #Sets the date disabled if not already set
             If ($DisabledOUComputer.ExtensionAttribute3 -eq "" -or $DisabledOUComputer.ExtensionAttribute3 -eq $null){
                 Write-Output ("Setting ExtensionAttribute 3 for Computer: " + $DisabledOUComputer.SamAccountName + " (computer was in disabled objects OU but did not have a disabled date.)")
 
                 $Date = "DISABLED ON " + (Get-Date)
                 Set-ADComputer -Identity $DisabledOUComputer.SamAccountName -Replace @{ExtensionAttribute3=$Date}
 
                 #Sets the variable for comparison in the rest of the loop. It was null.
                 $DisabledOUComputer.ExtensionAttribute3 = $Date
             }
 
             #Extracts the date disabled for comparison.
             $DateDisabled = [datetime]($DisabledOUComputer.ExtensionAttribute3.Replace('DISABLED ON ',''))
             $DaysDisabled = (New-TimeSpan -Start $DateDisabled -End (Get-Date)).Days
 
             #Increment through OUs
             If ($DaysDisabled -ge 30 -and $DaysDisabled -le 180 -and $DisabledOUComputer.DistinguishedName -notlike "*OU=30-180 Days,OU=Computers,$ParentOU"){
                 Write-Output ("Moving computer to the 30-180 Days OU: " + $DisabledOUComputer.SamAccountName)
                 Move-ADObject -Identity $DisabledOUComputer.DistinguishedName -TargetPath "OU=30-180 Days,OU=Computers,$ParentOU"
                 $30to180DayMovedComputers++
             }
             Else{
                 If ($DaysDisabled -gt 180 -and $DisabledOUComputer.DistinguishedName -notlike "*OU=Over 180 Days,OU=Computers,$ParentOU"){
                     Write-Output ("Moving computer to the Over 180 Days OU: " + $DisabledOUComputer.SamAccountName)
                     Move-ADObject -Identity $DisabledOUComputer.DistinguishedName -TargetPath "OU=Over 180 Days,OU=Computers,$ParentOU"
                     $180DayMovedComputers++
             }
         }
     }
 
 #SUMMARY OUTPUT
     #Writes the counts of what was modified etc.
     Write-Output "TOTALS:"
     $MovedUsers = $MovedUsers.tostring()
     Write-Output ($MovedUsers + " users were moved to the 0-30 Days OU.")
     $MovedComputers = $MovedComputers.tostring()
     Write-Output ($MovedComputers + " computers were moved to the 0-30 Days OU.")
     Write-Output ""
     $30to180DayMovedUsers = $30to180DayMovedUsers.tostring()
     Write-Output ($30to180DayMovedUsers + " users were moved to the 30-180 Days OU.")
     $30to180DayMovedComputers = $30to180DayMovedComputers.tostring()
     Write-Output ($30to180DayMovedComputers + " computers were moved to the 30-180 Days OU.")
     Write-Output ""
     $180DayMovedUsers = $180DayMovedUsers.tostring()
     Write-Output ($180DayMovedUsers + " users were moved to the Over 180 Days OU.")
     $180DayMovedComputers = $180DayMovedComputers.tostring()
     Write-Output ($180DayMovedComputers + " computers were moved to the Over 180 Days OU.")
     Write-Output ""
 
 #ATTRIBUTE CLEANUP
     #Gets all AD objects outside of the "disabled objects" OU with ExtensionAttribute3 set and clears it.
     Write-Output ""
     Write-Output "ATTRIBUTE CLEANUP:"
     Write-Output "Getting non-disabled objects with ExtensionAttribute3 set..."
     $NonDisabledUsers = Get-ADUser -Filter * -Properties DistinguishedName,ExtensionAttribute3,SamAccountName,Enabled | Where {`
         $_.DistinguishedName -NotLike "*$ParentOU" -and `
         $_.Enabled -eq $True -and `
         $_.ExtensionAttribute3 -ne "" -and `
         $_.ExtensionAttribute3 -ne $null `
     }
     $NonDisabledComputers = Get-ADComputer -Filter * -Properties DistinguishedName,ExtensionAttribute3,SamAccountName,Enabled | Where {`
         $_.DistinguishedName -NotLike "*$ParentOU" -and `
         $_.Enabled -eq $True -and `
         $_.ExtensionAttribute3 -ne "" -and `
         $_.ExtensionAttribute3 -ne $null `
     }
 
     Write-Output (($NonDisabledUsers.SamAccountName.Count).ToString() + " users were found.")
     Write-Output (($NonDisabledComputers.SamAccountName.Count).ToString() + " computers were found.")
 
     ForEach ($NonDisabledUser in $NonDisabledUsers){
         Write-Output ("Clearing ExtensionAttribute3 for user: " + $NonDisabledUser.SamAccountName)
         Set-ADUser -Identity $NonDisabledUser.SamAccountName -Clear ExtensionAttribute3
     }
 
     ForEach ($NonDisabledComputer in $NonDisabledComputers){
         Write-Output ("Clearing ExtensionAttribute3 for computer: " + $NonDisabledComputer.SamAccountName)
         Set-ADComputer -Identity $NonDisabledComputer.SamAccountName -Clear ExtensionAttribute3
     }
 
 Stop-Transcript