Tips for finding Knowledge Articles

  • - Enter just a few key words related to your question or problem
  • - Add Key words to refine your search as necessary
  • - Do not use punctuation
  • - Search is not case sensitive
  • - Avoid non-descriptive filler words like "how", "the", "what", etc.
  • - If you do not find what you are looking for the first time,reduce the number of key words you enter and try searching again.
  • - Minimum supported Internet Explorer version is IE9
Home  >

[HOWTO] Disable Inactive (AD) User Accounts using PowerShell

Privileged Access Service ,  

10 September,20 at 07:37 PM

About RSAT Powershell:

Remote Server Administration Tools (RSAT) allows analyst or administrators to remotely manage (Active Directory) using PowerShell commands or (scripts).


a.) Microsoft Windows Server 2008, 2012, 2016 (have not been tested on 2019)
b.) Remote Server Administration Tools (RSAT)
c.) Windows PowerShell

1.) Search/Launch “Windows PowerShell” as a “administrator” single “right click” on “Windows Powershell” and select “run as an administrator” and type the following command: 

     PS: C:\> Install-WindowsFeature RSAT-AD-Powershell

    Screenshot 1.)

    User-added image

    Screenshot 2 .) Installation has finish. (NOTE: The warning just tells you the role for your server is setup to receive automatic updates, because my VM is not on the internet Is why I see this message.  
     It doesn’t impact me running RSAT PowerShell commands / scripts.)

    User-added image

2.) Type the following command below to find all Inactive (AD) accounts in “Windows PowerShell”: 

     PS: C:\> Search-ADAccount -UserOnly -AccountInactive
    (NOTE: If you type part of the command like “Search-“ and hit the “tab” key It will fill out the rest of the command this includes parameters)

     User-added image

Question, do you have a PowerShell script to query (AD) accounts (60) days Inactive? Yes, download the attach  PowerShell script "SearchIAD90.ps1". The script queries (AD) Accounts that is (60) days Inactive.
(NOTE: To change the days edit the  variable "$days") 

Question, how can I query inactive accounts starting from a specific day and year using a PowerShell command?

(For example, I want to specify the following date 
“May 6th 2020” 
to query all Inactive (AD) Accounts up til the day I ran the PowerShell command)

    PS: C:\> Search-ADAccount –UsersOnly –AccountInactive -DateTime ‘5/06/2020’

     User-added image

3.) To disable the inactive (AD) account run command:

     PS: C:\> Disable-ADAccount -Identity AHouston 

     (NOTE:: I’m using the (AD) SamAccountName to disable the the Inactive (AD) Account

     User-added image

4.) To disable inactive (AD) Account starting from a specific day and year run command:

     PS: C:\> Search-ADAccount –UsersOnly –AccountInactive -DateTime ‘5/06/2020’ | Disable-ADAccount

     (NOTE: Only inactive (AD) accounts starting from the (day / year) specified for Ex. ‘5/06/2020’ till the (day / year) you ran the command will (only) be disabled.) 

     User-added image

5.) To view disable inactive (AD) accounts starting from a specific day in a comma-delimited excel format run command:

     PS: C:\> Search-ADAccount –UsersOnly –AccountInactive -DateTime ‘5/06/2020’ | Out-GridView

You can export the data into Excel for reporting purposes)

      User-added image
      User-added image