# Help with Active Directory User Disable Script

**URL:** <https://forums.powershell.org/t/help-with-active-directory-user-disable-script/8187>\
**Category:** PowerShell Help\
**Created:** [March 6, 2017, 11:18am UTC](https://forums.powershell.org/t/help-with-active-directory-user-disable-script/8187 "2017-03-06T11:18:33Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![devexityspace](https://avatars.discourse-cdn.com/v4/letter/d/d9b06d/32.png) [@devexityspace](https://forums.powershell.org/u/devexityspace)\
**Post date:** [March 6, 2017, 11:18am UTC](https://forums.powershell.org/t/help-with-active-directory-user-disable-script/8187/1 "2017-03-06T11:18:33Z")

</div>

I am pulling hairs right now. Im trying to disable user accounts that are inactive (haven’t logged in last 180 days), but exclude users who have been created in the last 30 days who haven’t logged in yet.

Currently I’m running:

Get-ADUser -SearchBase “OU=blah blah” -f \* -properties SamAccountName,LastLogonDate,createTimeStamp | Where-Object {($_.lastlogondate -le $180days) -AND ($_.whencreated -le $30days) -AND ($\_.enabled -eq $true)} | Export-CSV C:\blahblah\InactiveUsers.csv

My output shows a user who has a LastLogonDate of “2/8/2017” which is 27 days ago. He’s the ONLY problem child in my list.

Obviously there are no syntax errors, but I assume there is a logic error that is preventing my list to be accurate. Any help is appreciated.

---

<div class="post-metadata">

**Author:** ![skalizar](https://avatars.discourse-cdn.com/v4/letter/s/ecc23a/32.png) [@skalizar](https://forums.powershell.org/u/skalizar)\
**Post date:** [March 6, 2017, 11:31am UTC](https://forums.powershell.org/t/help-with-active-directory-user-disable-script/8187/2 "2017-03-06T11:31:14Z")

</div>

You are using when\_created in your comparison, but you are aren’t retrieving it, assuming you didn’t mix them up when posting.

---

<div class="post-metadata">

**Author:** ![daniel-krebs](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/daniel-krebs/32/484_2.png) [@daniel-krebs](https://forums.powershell.org/u/daniel-krebs)\
**Post date:** [March 6, 2017, 11:50am UTC](https://forums.powershell.org/t/help-with-active-directory-user-disable-script/8187/3 "2017-03-06T11:50:41Z")

</div>

I think you’ll need to change you -le operators (less than or equal) to -ge (greater than or equal) in the Where-Object filter. I’m assuming your $180days and $30days variables are set to a date 180 or 30 days ago.

---

<div class="post-metadata">

**Author:** ![sam-boutros](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/sam-boutros/32/5_2.png) [@sam-boutros](https://forums.powershell.org/u/sam-boutros)\
**Post date:** [March 6, 2017, 12:44pm UTC](https://forums.powershell.org/t/help-with-active-directory-user-disable-script/8187/4 "2017-03-06T12:44:06Z")

</div>

Try:

```
# Input
$LastLogon = (Get-Date).AddDays(-180)
$WhenCreated = (Get-Date).AddDays(-30)

# Initialize
$adsi = [adsisearcher]"objectcategory=user"
$adsi.SearchRoot = "LDAP://dc=$($env:USERDNSDOMAIN.replace('.',',dc='))"
$adsi.filter = "(!(UserAccountControl:1.2.840.113556.1.4.803:=2))" # enabled users
$adsi.PageSize = 1000000 
$ADUsersRaw = $adsi.FindAll()

# Process
$ADUsers = $ADUsersRaw | % { 
    if ($_.Properties.objectcategory -match 'CN=Person') {
        New-Object -TypeName PSObject -Property @{
            SamAccountName = $_.Properties.samaccountname | select -First 1 
            LastLogonDate = $(
                if ($_.Properties.lastlogontimestamp) {
                    [datetime]::FromFileTime(($_.Properties.lastlogontimestamp | select -First 1))
                }
            ) 
            createTimeStamp = $_.Properties.whencreated | select -First 1         
        }
    }
} 
$SelectADUsers = $ADUsers | where { $_.LastLogonDate -le $LastLogon -and $_.createTimeStamp -le $WhenCreated }

# Output
$SelectADUsers | select -First 20 | FT -a 
" Found $($SelectADUsers.Count) users created before $WhenCreated and have not logged on since $LastLogon"
```

---

<div class="post-metadata">

**Author:** ![devexityspace](https://avatars.discourse-cdn.com/v4/letter/d/d9b06d/32.png) [@devexityspace](https://forums.powershell.org/u/devexityspace)\
**Post date:** [March 6, 2017, 12:46pm UTC](https://forums.powershell.org/t/help-with-active-directory-user-disable-script/8187/5 "2017-03-06T12:46:13Z")

</div>

I tried prior replacing the -le with -ge, and Im still pulling the same account that was created on 2/8/2017. While the 2 lists are different (le shows 65 users, ge shows 157 users), it’s not pulling the right accounts in either situation.

---

<div class="post-metadata">

**Author:** ![daniel-krebs](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/daniel-krebs/32/484_2.png) [@daniel-krebs](https://forums.powershell.org/u/daniel-krebs)\
**Post date:** [March 6, 2017, 1:30pm UTC](https://forums.powershell.org/t/help-with-active-directory-user-disable-script/8187/6 "2017-03-06T13:30:07Z")

</div>

As Ron mentioned, you haven’t selected the whenCreated property but you’re testing for it. Get-ADUser does not return whenCreated by default. Please see if changing the condition in your Where-Object filter to createTimestamp or correcting the properties list of Get-ADUser fixes things.

```
Get-ADUser -SearchBase "OU=blah blah" -f * -properties SamAccountName,LastLogonDate,createTimeStamp | Where-Object {($_.lastlogondate -ge $180days) -AND ($_.createTimeStamp -ge $30days) -AND ($_.enabled -eq $true)} | Export-CSV C:\blahblah\InactiveUsers.csv
```

---

<div class="post-metadata">

**Author:** ![anton-pozdnyakov](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.powershell.org/anton-pozdnyakov/32/520_2.png) [@anton-pozdnyakov](https://forums.powershell.org/u/anton-pozdnyakov)\
**Post date:** [March 9, 2017, 4:15am UTC](https://forums.powershell.org/t/help-with-active-directory-user-disable-script/8187/7 "2017-03-09T04:15:32Z")

</div>

This might help: [http://www.adaxes.com/blog/cleanup-active-directory-with-powershell.html](http://www.adaxes.com/blog/cleanup-active-directory-with-powershell.html) It’s a script that can remove inactive users and take into account those who didn’t log on in the last XX days, exclude service accounts, users that have never logged on and other useful stuff.

---

<div class="post-metadata">

**Author:** ![dotnVo](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@dotnVo](https://forums.powershell.org/u/dotnVo)\
**Post date:** [May 16, 2024, 8:39pm UTC](https://forums.powershell.org/t/help-with-active-directory-user-disable-script/8187/8 "2024-05-16T20:39:08Z")

</div>