powershell - Inactive ADUser Query and ADGroup Manipulation Encountering Issues -
i'm trying (initially) query adusers in specific ou; identify 90-days inactive; document group memberships; make note in description field account being disabled of x-date; disable identified accounts; , move disabled accounts "parking" ou.
i've made notes in gist well, appreciate getting group membership piece working.
https://gist.github.com/rsmith7712/fdfe025d989508102044fdbbf5d3b9a8
i have not tested this, may 1 way solve problem
# http://stackoverflow.com/questions/37577369/inactive-aduser-query-and-adgroup-manipulation-encountering-issues # import modules needed import-module activedirectory # output results csv file $logfile = "c:\zombieacct_90dayrpt_n_move.csv" # today's date $today = get-date -uformat "%y/%m/%d" # date search $xdays = (get-date).adddays(-90) # expiration date $expire = (get-date).adddays(-1) # date disabled description variable $userdesc = "disabled inactive" + " - " + $today # sets ou base search user accounts, change required $searchbase = "ou=define,ou=define,ou=define,dc=define,dc=com" # sets ou accounts moved to, change required $parkingou = "ou=30days, ou=disabled accounts, ou=domain services, dc=define, dc=com" # pull inactive users older 90-days specified ou $users = get-aduser -searchbase $searchbase -properties memberof, lastlogondate, passwordlastset, passwordneverexpires, whencreated, displayname -filter { (lastlogondate -notlike '*' -or lastlogondate -le $xdays) -and (passwordlastset -le $xdays) -and (enabled -eq $true) -and (passwordneverexpires -eq $false) -and (whencreated -le $xdays) } | foreach-object { set-aduser $_ -accountexpirationdate $expire -description $userdesc -whatif move-adobject $_ -targetpath $parkingou -whatif $_ | select displayname, name, samaccountname, passwordexpired, passwordneverexpires, whencreated, passwordlastset, lastlogondate, @{n='groups';e={(($_.memberof | get-adgroup).name) -join '; '}} } $users | export-csv $logfile -notypeinformation start $logfile 