Monday, May 19, 2014

Disabling a user via Powershell

Here's my best script ever created.  It not only disables a users domain account, but it changes the Description field to include "TERM $(Get-Date)", it also moves the account to a Disabled users OU, clears the manager field, changes the password to one that is common across IT and hides the associated SMTP address from the GAL.

#Script to disable domain user accounts, move to Disabled OU, change password to P@$$word1 and hide from GAL.
#Oct, 2013 Ben Hart

set-executionpolicy unrestricted -force
Import-Module -Name ActiveDirectory
$User = Read-Host "Enter user name"

#Hide from GAL and set Description
"Account is hidden"
Set-ADUser $User -Description "TERM $(Get-Date)"
Set-ADUser $User -Replace @{msExchHideFromAddressLists="TRUE"}

#Disable the account
"Account is disabled"
Disable-ADAccount $User

#Clear Manager field
Set-aduser $User -manager $null

#Move the account
"Account is moved to the appropriate OU"
Get-ADUser $User | Move-ADObject -TargetPath "ou=disabled accounts,dc=domain,dc=org"
"Account is disabled and moved"
Set-ADAccountPassword -identity $User -newpassword (ConvertTo-secureString "P@$$word1" -force) -Reset 
"Have a nice day"

No comments:

Post a Comment