# encoding: ascii
# api: powershell
# title: Delete AD Users
# description: This script will delete all Active Directory User accounts that have not logged in within the number of days specified in the $NumDays variable. The script only deletes the Active Directory user accounts, not any associated Exchange mailboxes. The script also includes the Delete-ADUser function, which can be used separately from this script. All accounts that are deleted are logged in the “Removed-User-Accounts.log” file found in the local directory. The format of the log file is very basic, but effective.
# version: 0.1
# type: function
# author: AlphaSun
# license: CC0
# function: Delete-ADUser
# x-poshcode-id: 2938
# x-archived: 2017-03-23T21:12:33
# x-published: 2012-08-31T14:38:00
#
#
function Delete-ADUser
{
Param($userName = $(throw 'Enter a username to delete'))
$searcher = New-Object System.DirectoryServices.DirectorySearcher([ADSI]"","(&(objectcategory=user)(sAMAccountName=$userName))")
$user = $searcher.findone().GetDirectoryEntry()
$user.psbase.DeleteTree()
}
$NumDays = 90
$LogDir = ".\Removed-User-Accounts.log"
$currentDate = [System.DateTime]::Now
$currentDateUtc = $currentDate.ToUniversalTime()
$lltstamplimit = $currentDateUtc.AddDays(- $NumDays)
$lltIntLimit = $lltstampLimit.ToFileTime()
$adobjroot = [adsi]''
$objstalesearcher = New-Object System.DirectoryServices.DirectorySearcher($adobjroot)
$objstalesearcher.filter = "(&(objectCategory=person)(objectClass=user)(lastLogonTimeStamp<=" + $lltIntLimit + "))"
$users = $objstalesearcher.findone()
Write-Output `n`n"----------------------------------------" "ACCOUNTS OLDER THAN "$NumDays" DAYS" "PROCESSED ON:" $currentDate "----------------------------------------" `
| Out-File $LogDir -append
if ($users.Count -eq 0)
{
Write-Output " No account needs to be removed." | Out-File $LogDir -append
}
else
{
foreach ($user in $users)
{
# Read the user properties
[string]$adsPath = $user.Properties.adspath
[string]$displayName = $user.Properties.displayname
[string]$samAccountName = $user.Properties.samaccountname
[string]$lastLogonInterval = $user.Properties.lastlogontimestamp
# Delete the user
Delete-ADUser $samAccountName
# Convert the date and time to the local time zone
$lastLogon = [System.DateTime]::FromFileTime($lastLogonInterval)
Write-Output " Removed user " $displayName" | Username: "$samAccountName" | Last Logon: "$lastLogon"`n" `
| Out-File $LogDir -append
}
}