Tips for finding Knowledge Articles

  • - Enter just a few key words related to your question or problem
  • - Add Key words to refine your search as necessary
  • - Do not use punctuation
  • - Search is not case sensitive
  • - Avoid non-descriptive filler words like "how", "the", "what", etc.
  • - If you do not find what you are looking for the first time,reduce the number of key words you enter and try searching again.
  • - Minimum supported Internet Explorer version is IE9
Home  >
article

[HOWTO] Disable Inactive (AD) User Accounts using PowerShell

Privileged Access Service ,  

10 September,20 at 07:37 PM

About RSAT Powershell:

Remote Server Administration Tools (RSAT) allows analyst or administrators to remotely manage (Active Directory) using PowerShell commands or (scripts).


Prerequisites:

a.) Microsoft Windows Server 2008, 2012, 2016 (have not been tested on 2019)
b.) Remote Server Administration Tools (RSAT)
c.) Windows PowerShell

1.) Search/Launch “Windows PowerShell” as a “administrator” single “right click” on “Windows Powershell” and select “run as an administrator” and type the following command: 

     PS: C:\> Install-WindowsFeature RSAT-AD-Powershell

    Screenshot 1.)

    User-added image

    Screenshot 2 .) Installation has finish. (NOTE: The warning just tells you the role for your server is setup to receive automatic updates, because my VM is not on the internet Is why I see this message.  
     It doesn’t impact me running RSAT PowerShell commands / scripts.)

    User-added image

2.) Type the following command below to find all Inactive (AD) accounts in “Windows PowerShell”: 

     PS: C:\> Search-ADAccount -UserOnly -AccountInactive
 
    (NOTE: If you type part of the command like “Search-“ and hit the “tab” key It will fill out the rest of the command this includes parameters)

     User-added image


Question, do you have a PowerShell script to query (AD) accounts (60) days Inactive? Yes, download the attach  PowerShell script "SearchIAD90.ps1". The script queries (AD) Accounts that is (60) days Inactive.
(NOTE: To change the days edit the  variable "$days") 

Question, how can I query inactive accounts starting from a specific day and year using a PowerShell command?

(For example, I want to specify the following date 
“May 6th 2020” 
to query all Inactive (AD) Accounts up til the day I ran the PowerShell command)

    PS: C:\> Search-ADAccount –UsersOnly –AccountInactive -DateTime ‘5/06/2020’

     User-added image

3.) To disable the inactive (AD) account run command:

     PS: C:\> Disable-ADAccount -Identity AHouston 

     (NOTE:: I’m using the (AD) SamAccountName to disable the the Inactive (AD) Account

     User-added image


4.) To disable inactive (AD) Account starting from a specific day and year run command:

     PS: C:\> Search-ADAccount –UsersOnly –AccountInactive -DateTime ‘5/06/2020’ | Disable-ADAccount

     (NOTE: Only inactive (AD) accounts starting from the (day / year) specified for Ex. ‘5/06/2020’ till the (day / year) you ran the command will (only) be disabled.) 

     User-added image


5.) To view disable inactive (AD) accounts starting from a specific day in a comma-delimited excel format run command:

     PS: C:\> Search-ADAccount –UsersOnly –AccountInactive -DateTime ‘5/06/2020’ | Out-GridView

     (NOTE:
You can export the data into Excel for reporting purposes)


      User-added image
      User-added image

Still have questions? Click here to log a technical support case, or collaborate with your peers in Centrify's Online Community.