# encoding: ascii
# api: powershell
# title: Disable AD Users
# description: This script will disable all Active Directory User accounts that have not logged in within the number of days specified by the $NumDays variable. All accounts that are disabled are logged in the “Disabled-User-Accounts.log” file created in the local directory. The formatting of the log file is very basic, but effective.
# version: 0.1
# type: class
# author: AlphaSun
# license: CC0
# x-poshcode-id: 3484
# x-archived: 2012-12-17T23:31:15
# x-published: 2012-06-28T13:28:00
#
#
$NumDays = 90
$LogDir = ".\Disabled-User-Accounts.log"
$currentDate = [System.DateTime]::Now
$currentDateUtc = $currentDate.ToUniversalTime()
$lltstamplimit = $currentDateUtc.AddDays(- $NumDays)
$lltIntLimit = $lltstampLimit.ToFileTime()
$adobjroot = [adsi]''
$objstalesearcher = New-Object System.DirectoryServices.DirectorySearcher($adobjroot)
$objstalesearcher.filter = "(&(objectCategory=person)(objectClass=user)(lastLogonTimeStamp<=" + $lltIntLimit + "))"
$users = $objstalesearcher.findall()
Write-Output `n`n"----------------------------------------" "ACCOUNTS OLDER THAN "$NumDays" DAYS" "PROCESSED ON:" $currentDate "----------------------------------------" `
| Out-File $LogDir -append
if ($users.Count -eq 0)
{
Write-Output " No account needs to be disabled." | Out-File $LogDir -append
}
else
{
foreach ($user in $users)
{
# Read the user properties
[string]$adsPath = $user.Properties.adspath
[string]$displayName = $user.Properties.displayname
[string]$samAccountName = $user.Properties.samaccountname
[string]$lastLogonInterval = $user.Properties.lastlogontimestamp
# Disable the user
$account=[ADSI]$adsPath
$account.psbase.invokeset("AccountDisabled", "True")
$account.setinfo()
# Convert the date and time to the local time zone
$lastLogon = [System.DateTime]::FromFileTime($lastLogonInterval)
Write-Output " Disabled user " $displayName" | Username: "$samAccountName" | Last Logon: "$lastLogon"`n" `
| Out-File $LogDir -append
}
}