Script tìm và disable các account không đăng nhập trong vòng 90 ngày trên AD

# disableUsers.ps1  

# Set msDS-LogonTimeSyncInterval (days) to a sane number.  By

# default lastLogonDate only replicates between DCs every 9-14 

# days unless this attribute is set to a shorter interval.

 

# Also, make sure to create the EventLog source before running, or

# comment out the Write-EventLog lines if no event logging is

# needed.  Only needed once on each machine running this script.

# New-EventLog -LogName Application -Source "DisableUsers.ps1"

 

# Remove "-WhatIf"s before putting into production.

 

Import-Module ActiveDirectory

 

$inactiveDays = 90

$neverLoggedInDays = 90

$disableDaysInactive=(Get-Date).AddDays(-($inactiveDays))

$disableDaysNeverLoggedIn=(Get-Date).AddDays(-($neverLoggedInDays))

 

# Identify and disable users who have not logged in in x days

 

$disableUsers1 = Get-ADUser -Filter {Enabled -eq $TRUE} -Properties lastLogonDate, whenCreated, distinguishedName | Where-Object {($_.lastLogonDate -lt $disableDaysInactive) -and ($_.lastLogonDate -ne $NULL)}

 

 $disableUsers1 | ForEach-Object {

   Disable-ADAccount $_

   #Write-EventLog -Source "DisableUsers.ps1" -EventId 9090 -LogName Application -Message "Attempted to disable user $_ because the last login was more than $inactiveDays ago."

   }

 

# Identify and disable users who were created x days ago and never logged in.

 

$disableUsers2 = Get-ADUser -Filter {Enabled -eq $TRUE} -Properties lastLogonDate, whenCreated, distinguishedName | Where-Object {($_.whenCreated -lt $disableDaysNeverLoggedIn) -and (-not ($_.lastLogonDate -ne $NULL))}

 

$disableUsers2 | ForEach-Object {

   Disable-ADAccount $_

   #Write-EventLog -Source "DisableUsers.ps1" -EventId 9091 -LogName Application -Message "Attempted to disable user $_ because user has never logged in and $neverLoggedInDays days have passed."

   }