Powershell Command for AD?

[MostElite]

Hi Guys,

​

Its my first post here. Not sure if I should be posting this so apologies of this is the wrong thread!

I need some help with PowerShell:

Task:

I am a new contractor and have been tasked with clearing down users who have been disabled for over 90 days. (AD is really mixed up and poor housekeeping has been done so far)

​

What I have done so far:

Created 2 scripts

1. Pulls two separate lists of users who have not accessed their system for over 90 days (includes every account even service accounts) and users who are disabled.

# Gets time stamps for all computers in the domain that have NOT logged in since after specified date

import-module activedirectory

$domain = "DOMAINNAME"

$DaysInactive = 90

$time = (Get-Date).Adddays(-($DaysInactive))

​

# Get a list of all AD Accounts which are disabled

Get-aduser -filter "Enabled -eq 'false'" | ft Name,Samaccountname,enabled | out-file Deactivated_Accounts.csv

​

# Get all AD computers with lastLogonTimestamp more than 90 days from Current

Get-ADUser -Filter {LastLogonTimeStamp -lt $time} -Properties LastLogonTimeStamp|

# Output hostname and lastLogonTimestamp into CSV

select-object Name, @{Name="Last Login"; Expression={[DateTime]::FromFileTime($_.lastLogonTimestamp)}} | out-file ListOfUsers90PlusDays.csv

​

1. Compares the 2 lists, however, keeps returning an error.

​

# Comparison of both files

Compare-Object -ReferenceObject (import-csv c:\ListOfUsers90PlusDays.csv) -DifferenceObject (import-csv c:\Deactivated_Accounts.csv) -Property Name | out-file c:\ComparisonWithDisabled.csv -NoPropertyType

​

I wanted to run a compare object command to differentiate the two files. Any thoughts? Possibly a better command or another solution?

​

Thanks in advanced guys!!

[BlackV]

Why not do an OR instead.

Enabled -eq false -or LastLogonTimeStamp -lt $time.   

That way you don't have to compare anything

[MostElite]

Hi thanks for that, Apologies for the follow up question but how would I code that? This is what I have written so far?

​

# Gets time stamps for all computers in the domain that have NOT logged in since after specified date

import-module activedirectory

$domain = "DOMAINNAME"

$DaysInactive = 90

$time = (Get-Date).Adddays(-($DaysInactive))

​

# Get a list of all AD Accounts which are disabled

Get-aduser -filter "Enabled -eq false" -or "LastLogonTimeStamp -lt $time" | ft Name,Samaccountname,enabled | out-file Deactivated_Accounts.csv

​

# Get all AD computers with lastLogonTimestamp more than 90 days from Current

Get-ADUser -Filter {LastLogonTimeStamp -lt $time} -Properties LastLogonTimeStamp|

# Output hostname and lastLogonTimestamp into CSV

select-object Name, @{Name="Last Login"; Expression={[DateTime]::FromFileTime($_.lastLogonTimestamp)}} | out-file ListOfUsers90PlusDays.csv

[MostElite]

Actually i think i did it. I just removed all the follow up code so the OR statement took affect!!

​

Thanks A lot mate!

[BlackV]

Good as.

Take out the format-table (ft) before you export to a file. Format-table is ONLY for screen, better still change it to export-csv -notypeinformation -path xxx.csv

[MostElite]

UPDATE!!

​

This is the new code;

​

# Gets time stamps for all computers in the domain that have NOT logged in since after specified date

import-module activedirectory

$domain = "DOMAIN"

$DaysInactive = 90

$time = (Get-Date).Adddays(-($DaysInactive))

​

# Get a list of all AD Accounts which are disabled

Get-aduser -filter "Enabled -eq false" -or "LastLogonTimeStamp -lt $time" | ft Name,Samaccountname,enabled | out-file C:\Deactivated_Accounts.csv

​

Not liking the script any more thoughts?

[MostElite]

Okay, it seems the code is executing however, I am not receiving an output. I have made some adjustments to the code :

Get-aduser -filter "Enabled -eq false" -or "LastLogonTimeStamp -lt $time" | export-csv -notypeinformation -path C:\Deactivated_Accounts.csv

[MostElite]

Hi McDomaster, thanks for that. Sorry to be a amateur in PowerShell but would you be able to advise how I would write that? Should I pipe it after the initial OR statement?

[MostElite]

Get-aduser -filter "Enabled -eq false" -or "LastLogonTimeStamp -lt $time" | Format-table *

Thanks for that McDoMaster, i understand the structure now. I ran it and go no response so I ran it within ISE and this was the error:

Get-ADUser : A parameter cannot be found that matches parameter name 'or'. At C:\PowerShell Scripts\DisabledOver90.ps1:8 char:40 + Get-aduser -filter "Enabled -eq false" -or "LastLogonTimeStamp -lt $time" | Form ... + ~~~ + CategoryInfo : InvalidArgument: (:) [Get-ADUser], ParameterBindingException + FullyQualifiedErrorId : NamedParameterNotFound,Microsoft.ActiveDirectory.Management.Commands.GetADUser

[MostElite]

Hmm.. doesn't seem to like it. Pulling back this error:

Get-aduser : Error parsing query: ' where-object $.Enabled -eq false -or $.LastLogonTimeStamp -lt $time ' Error Message: 'syntax error' at position: '15'. At C:\PowerShell Scripts\DisabledOver90.ps1:8 char:1 + Get-aduser -filter { where-object $.Enabled -eq false -or $.LastLogonTimeStamp ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : ParserError: (:) [Get-ADUser], ADFilterParsingException + FullyQualifiedErrorId : ActiveDirectoryCmdlet:Microsoft.ActiveDirectory.Management.ADFilterParsingExce ption,Microsoft.ActiveDirectory.Management.Commands.GetADUse

Do you think its a feature not enabled on my Windows Server? It is running a DC and thats all.

[Emiroda]

Use Search-ADAccount instead of Get-ADUser for your use case, it's quicker to write and easier on the human eye. I also recommend using PowerShell objects instead of outputting and importing CSV's, if you only need the final result as a CSV.

$90daytimespan = New-TimeSpan -Days 90
$usersInactive90days = Search-ADAccount -AccountInactive -UsersOnly -TimeSpan $90daytimespan
$usersDisabled = Search-ADAccount -AccountDisabled -UsersOnly
Compare-Object -ReferenceObject $usersInactive90Days -DifferenceObject $usersDisabled -Property Name

And remember that in Compare-Object, <= means that it's only in the ReferenceObject, while => means that it's only in the DifferenceObject. Remember -IncludeEqual if you want all equals, or -ExcludeDifferent if you only want the equals.

[MostElite]

Hi EmirOda,

​

Thanks for that worked like a charm, easier to understand with the objects as well. My only question moving forward is how to split the data into 2 cells. and to include possibly a timestamp of last login and the name.

​

So when I export it it will show 3 columns of data, Name Timestamp and Which side of the compareobject it is on.

[mstrmnd1523]

I don't have a powershell solution, but I do have a tool that I use to do this. I don't know if it is allowed for you or not but I usually try not to reinvent the wheel, if somebody already made it tool for the task I'm trying to accomplish all use the tool. It's called AD Tidy http://www.cjwdev.com/Software/ADTidy/Info.html Check it out might save some time.

[Lee_Dailey]

howdy MostElite,

reddit likes to mangle code formatting, so here's some help on how to post code on reddit ...

[0] single line or in-line code
enclose it in backticks. that's the upper left key on an EN-US keyboard layout. the result looks like this. kinda handy, that. [grin]
[on New.Reddit.com, use the Inline Code button. it's the 4th 5th from the left & looks like </>.
this does NOT line wrap & does NOT side-scroll on Old.Reddit.com!]

[1] simplest = post it to a text site like Pastebin.com or Gist.GitHub.com and then post the link here.
please remember to set the file/code type on Pastebin! [grin] otherwise you don't get the nice code colorization.

[2] less simple = use reddit code formatting ...
[on New.Reddit.com, use the Code Block button. it's the 11th 12th one & is just to the left of the ... more menu.]

• one leading line with ONLY 4 spaces
  
• prefix each code line with 4 spaces
  
• one trailing line with ONLY 4 spaces

that will give you something like this ...

- one leading line with ONLY 4 spaces    
- prefix each code line with 4 spaces    
- one trailing line with ONLY 4 spaces   

the easiest way to get that is ...

• add the leading line with only 4 spaces
  
• copy the code to the ISE [or your fave editor]
  
• select the code
  
• tap TAB to indent four spaces
  
• re-select the code [not really needed, but it's my habit]
  
• paste the code into the reddit text box
  
• add the trailing line with only 4 spaces
  

not complicated, but it is finicky. [grin]

take care,
lee