UPDATED Disable AD Accounts with Powershell

August 21, 2008 · Filed Under Active Directory, Exchange Server 2007, Powershell | 113 views

As a followup to the disabling AD accounts post earlier this month, I’ve updated the Power Shell (requires the Exchange Management Shell) script some to add some additional functionality.

New features:

The username of the the administrator running the script is recorded in the text file that lists all of the groups the account was removed from.
An email is automatically created and sent to the configured recipients (such as the AD Administrators group and/or Information Security…), which is fantastic from an end-to-end accountability and auditing point of view (who did it, when did they do it and why…)

Just find the following variables in the script and change them accordingly:

$EmailReportFile = “\\YOUR_SERVER_PATH_HERE\Account_Disables_Report.txt”
- This is the full UNC path to where you want the report saved (this is what is emailed out)
$domain = “LDAP://dc=DOMAIN,dc=local”
- The LDAP bind URL for your domain…
$To = “someone@yourcompany.com”
- SMTP addresses, comma seperated, of who you want the report emailed to
$SmtpClient.host = “smtp.yourcompany.com”
- The SMTP host name to handle your email report (your Exchagne 2007 Hub Transport server(s) or Exchange 2003/2000 front-end server(s) typically, make sure you can perform anonymous relay internally though….)