Disabling Active Directory User Accounts, Part 1
For a few years now I’ve been using a custom VBScript to disable AD accounts when employees leave the organization. The script was pieced together from some things I knew how to do and others I was able to find elsewhere. The script performed the following tasks:
- Disabled the specified AD account
- Hid the mailbox from the Global Address List
- Removed the account from all groups it was a member of
- Created a text file log of all groups the account was a member of
- Set the password to be changed at the next login
- Set the disable date in the “Title” field (an unused field in my organization)
- Set the RAS settings to disabled
After our upgrade to Exchange Server 2007 earlier this year I noticed that the script was not functioning fully the way it should have. Specifically, the hiding of the mailbox from the GAL was not occurring. Sure, if you looked at the mailbox of an account that had been disabled using the script in the Exchange Management Console, the check box to hide the mailbox from the GAL was checked, but just the same the mailbox was not really hidden from the GAL.
So to correct this issue, I wrote a new script in Powershell (requires the Exchange Management Shell snapin) script that would perform all of the same actions except setting the RAS attribute to disabled.
Both scripts are attached, and annotated where I remembered where certain portions of the script or ideas came from. The VBScript should be able to be run without any changes unless you want to change what it does. The Powershell (Exchange Management Shell) script should only require one change in the variable $domain as shown here: $domain = LDAP://dc=mydomain,dc=local.
VBScript version:
disable_accounts_single.zip (1.7 KiB, 1,409 hits)
Powershell (Exchange Management Shell) version:
Disable-ADAccounts.zip (1.8 KiB, 1,200 hits)
Comments
2 Responses to “Disabling Active Directory User Accounts, Part 1”
Leave a Reply
-
Translator
[...] a followup to the disabling AD accounts post earlier this month, I’ve updated the Power Shell (requires the Exchange Management Shell) script some to add [...]
[...] a followup to the Disabling Active Directory User Accounts, Part 1 post, here’s a Powershell script that will disable multiple accounts for you by using a CSV input [...]