{"id":17411,"date":"2010-08-16T00:01:00","date_gmt":"2010-08-16T00:01:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2010\/08\/16\/using-powershell-to-find-all-disabled-users-in-active-directory\/"},"modified":"2010-08-16T00:01:00","modified_gmt":"2010-08-16T00:01:00","slug":"using-powershell-to-find-all-disabled-users-in-active-directory","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/using-powershell-to-find-all-disabled-users-in-active-directory\/","title":{"rendered":"Using PowerShell to Find All Disabled Users in Active Directory"},"content":{"rendered":"

 <\/p>\n

Summary<\/b>: The Scripting Guys discuss three different approaches to finding disabled user accounts in Active Directory Domain Services by using Windows PowerShell.<\/p>\n

 <\/p>\n

\"Hey,<\/span><\/span>Hey, Scripting Guy! I would like to use Windows PowerShell to search Active Directory<\/a> Domain Services (AD DS) for user accounts that are disabled. I had a VBScript script I had obtained from the Scripting Guys a long time ago,<\/a> but it is confusing and I would like to find a different approach if possible. We are migrating our scripting environment from VBScript to Windows PowerShell, so I would like to replace this script if possible. <\/p>\n

— EJ<\/p>\n

 <\/p>\n

\"Hey,<\/span><\/span>Hello EJ, <\/p>\n

Microsoft Scripting Guy Ed Wilson here I am having flashbacks of currywurst<\/a>, cool breezes coming across the Alster<\/a>, long walks through green meadows, and long talks into the evening with awesome friends. I was writing the chapters on Active Directory of my Windows PowerShell Scripting Guide<\/a> book for Microsoft Press when I arrived in Hamburg<\/a> on the ICE Train<\/a> from Frankfurt<\/a>. I took the following photo on a walk around the lake. The breeze caused the fountain to spray mist creating a rainbow near the water. <\/p>\n

\"Photo<\/a> <\/p>\n

The ICE trains all have power outlets in them, which meant I was able to work on my laptop the entire train ride. Using Virtual PC 2007, I fired up an Active Directory domain controller and a workstation in the same domain, and set about writing Active Directory Service Interfaces (ADSI) code to locate disabled user accounts. <\/p>\n

The script I wrote to find disabled user accounts in my domain uses the Win32_UserAccount<\/b> WMI<\/a> class. It is a very easy class to use in Windows PowerShell, and it works well for small domains. The script listed here also appeared in the Windows Server 2008 Security Resource Kit<\/a> that was part of the Windows Server 2008 Resource Kit<\/a> (I wrote all 150 Windows PowerShell scripts that appear in those volumes). <\/p>\n

For other articles about searching Active Directory using Windows PowerShell, see this collection of Hey, Scripting Guy! Blog posts<\/a>. <\/p>\n

\n

LocateDisabledUsers.ps1<\/strong><\/p>\n

param(<\/span>
<\/span>$domain<\/span>=<\/span>$env<\/span>:userdomain,<\/span>
<\/span>[switch]<\/span>$query<\/span>,<\/span>
<\/span>[switch]<\/span>$whatif<\/span>,<\/span>
<\/span>[switch]<\/span>$help<\/span>,<\/span>
<\/span>[switch]<\/span>$examples<\/span>,<\/span>
<\/span>[switch]<\/span>$min<\/span>,<\/span>
<\/span>[switch]<\/span>$full<\/span>
<\/span>)<\/span> <\/span>#<\/span>end<\/span> <\/span>param<\/span>
<\/span>#<\/span> <\/span>Begin<\/span> <\/span>Functions<\/span>
<\/span>function<\/span> <\/span>funHelp()<\/span>
<\/span>{<\/span>
<\/span>$descriptionText<\/span>=<\/span> <\/span>`<\/span>
<\/span>@<\/span>”
NAME: LocateDisabledUsers.ps1 
DESCRIPTION:
Locates disabled users a local or remote domain by
supplying the netbios name of the domain. 
The script can query multiple domains by accepting 
more than one value for the -domain parameter. The 
script also supports using -whatif to prototype the 
command prior to execution
PARAMETERS: 
-domain the domain or domains to query for locked 
out users. Note: this is the netbios domain name.
Does not accept fully qualified domain name. For
example: nwtraders is correct, nwtraders.com is 
not.
-query executes the query
-whatif prototypes the command.
-help prints help description and parameters file
-examples prints only help examples of syntax
-full prints complete help information
-min prints minimal help. Modifies -help
“<\/span>@<\/span> <\/span>#<\/span>end<\/span> <\/span>descriptionText<\/span>
<\/span>$examplesText<\/span>=<\/span> <\/span>`<\/span>
<\/span>@<\/span>”
SYNTAX:
LocateDisabledUsers.ps1
Displays an error missing parameter, and calls help
LocateDisabledUsers.ps1 -query
Queries disabled user accounts. The domain queried is
the local logged on users domain from the machine 
that launched the script 
LocateDisabledUsers.ps1 -domain nwtraders, contoso -query
Queries disabled user accounts in the nwtraders domain and
in the contoso domain. The script is executed locally 
LocateDisabledUsers.ps1 -query -domain nwtraders -whatif
Displays what if: Perform operation locate disabled 
users from the nwtraders domain.The query will execute 
from the localhost computer
LocateDisabledUsers.ps1 -help
Prints the help topic for the script
LocateDisabledUsers.ps1 -help -full
Prints full help topic for the script
LocateDisabledUsers.ps1 -help -examples
Prints only the examples for the script
LocateDisabledUsers.ps1 -examples
Prints only the examples for the script
“<\/span>@<\/span> <\/span>#<\/span>end<\/span> <\/span>examplesText<\/span>
<\/span>$remarks<\/span> <\/span>=<\/span> <\/span>`<\/span>
”
REMARKS
For more information, type: $($MyInvocation.ScriptName) -help -full
” <\/span>#<\/span>end<\/span> <\/span>remarks<\/span>
<\/span>if<\/span>(<\/span>$examples<\/span>)<\/span> <\/span>{<\/span> <\/span>$examplesText<\/span> <\/span>;<\/span> <\/span>$remarks<\/span> <\/span>;<\/span> <\/span>exit<\/span> <\/span>}<\/span>
<\/span>if<\/span>(<\/span>$full<\/span>)<\/span> <\/span>{<\/span> <\/span>$descriptionText<\/span>;<\/span> <\/span>$examplesText<\/span> <\/span>;<\/span> <\/span>exit<\/span> <\/span>}<\/span> 
<\/span>if<\/span>(<\/span>$min<\/span>)<\/span> <\/span>{<\/span> <\/span>$descriptionText<\/span> <\/span>;<\/span> <\/span>exit<\/span> <\/span>}<\/span>
<\/span>$descriptionText<\/span>;<\/span> <\/span>$remarks 
<\/span>exit<\/span>
<\/span>}<\/span> <\/span>#<\/span>end<\/span> <\/span>funHelp<\/span> <\/span>function<\/span>
<\/span>function<\/span> <\/span>funline<\/span> <\/span>(<\/span>
<\/span>$strIN<\/span>,<\/span>
<\/span>$char<\/span> <\/span>=<\/span> “=”<\/span>,<\/span>
<\/span>$sColor<\/span> <\/span>=<\/span> “Yellow”<\/span>,<\/span>
<\/span>$uColor<\/span> <\/span>=<\/span> “darkYellow”<\/span>,<\/span>
<\/span>[switch]<\/span>$help<\/span>
<\/span>)<\/span>
<\/span>{<\/span>
<\/span>if<\/span>(<\/span>$help<\/span>)<\/span>
<\/span>{<\/span>
<\/span>$local<\/span>:helpText<\/span> <\/span>=<\/span> <\/span>`<\/span>
<\/span>@<\/span>”
Funline accepts inputs: -strIN for input string and -char for seperator
-sColor for the string color, and -uColor for the underline color. Only 
the -strIn is required. The others have the following default values:
-char: =, -sColor: Yellow, -uColor: darkYellow
Example:
funline -strIN “<\/span>Hello<\/span> <\/span>world<\/span>”
funline -strIn “<\/span>Morgen<\/span> <\/span>welt<\/span>” -char “<\/span>–<\/span>” -sColor “<\/span>blue<\/span>” -uColor “<\/span>yellow<\/span>”
funline -help
“<\/span>@<\/span>
<\/span>$local<\/span>:helpText<\/span>
<\/span>break<\/span>
<\/span>}<\/span> <\/span>#<\/span>end<\/span> <\/span>funline<\/span> <\/span>help<\/span>
<\/span>$strLine<\/span>=<\/span> <\/span>$char<\/span> <\/span>*<\/span> <\/span>$strIn<\/span>.length<\/span>
<\/span>Write-Host<\/span> <\/span>-ForegroundColor<\/span> <\/span>$sColor<\/span> <\/span>$strIN<\/span> 
<\/span>Write-Host<\/span> <\/span>-ForegroundColor<\/span> <\/span>$uColor<\/span> <\/span>$strLine<\/span>
<\/span>}<\/span> <\/span>#<\/span>end<\/span> <\/span>funLine<\/span> <\/span>function<\/span>
<\/span>Function<\/span> <\/span>funWhatIf()<\/span>
<\/span>{<\/span>
<\/span>foreach<\/span>(<\/span>$sDomain<\/span> <\/span>in<\/span> <\/span>$Domain<\/span>)<\/span>
<\/span>{<\/span>
“what if: Perform operation locate disabled users from the $sDomain domain”
<\/span>}<\/span>
<\/span>exit<\/span>
<\/span>}<\/span> <\/span>#<\/span>end<\/span> <\/span>funWhatIf<\/span>
<\/span>Function<\/span> <\/span>funQuery()<\/span>
<\/span>{<\/span>
<\/span>Foreach<\/span>(<\/span>$sDomain<\/span> <\/span>in<\/span> <\/span>$domain<\/span>)<\/span>
<\/span>{<\/span>
<\/span>$strOutput<\/span> <\/span>=<\/span> <\/span>Get-WmiObject<\/span> <\/span>-Class<\/span> <\/span>win32_useraccount<\/span> <\/span>-filter<\/span> <\/span>`<\/span>
“domain = “”$sDomain”” AND disabled = ‘true'”
<\/span>$count<\/span> <\/span>=<\/span> <\/span>(<\/span>$strOutput<\/span> <\/span>|<\/span> <\/span>Measure-Object<\/span>).count<\/span>
<\/span>If<\/span>(<\/span>$count<\/span> <\/span>-eq<\/span> <\/span>0<\/span>)<\/span>
<\/span>{<\/span> 
<\/span>funline<\/span> <\/span>-scolor<\/span> <\/span>green<\/span> <\/span>-ucolor<\/span> <\/span>darkyellow<\/span> <\/span>-strIN<\/span> <\/span>`<\/span>
“There are no disabled accounts in the $sDomain” 
<\/span>}<\/span> <\/span>#<\/span>end<\/span> <\/span>if<\/span>
<\/span>ELSE<\/span>
<\/span>{<\/span>
<\/span>funline<\/span> <\/span>-scolor<\/span> <\/span>red<\/span> <\/span>-ucolor<\/span> <\/span>darkyellow<\/span> <\/span>-strIN<\/span> <\/span>`<\/span>
“$count disabled in the $sDomain domain — List follows:” 
<\/span>format-table<\/span> <\/span>-property<\/span> <\/span>name,<\/span> <\/span>sid<\/span> <\/span>-AutoSize<\/span> <\/span>-inputobject<\/span> <\/span>$strOutput<\/span>
<\/span>}<\/span> <\/span>#<\/span>end<\/span> <\/span>else<\/span>
<\/span>}<\/span> <\/span>#<\/span>end<\/span> <\/span>foreach<\/span>
<\/span>exit<\/span>
<\/span>}<\/span> <\/span>#<\/span>end<\/span> <\/span>funquery<\/span>
<\/span>#<\/span> <\/span>Entry<\/span> <\/span>Point<\/span>
<\/span>if<\/span>(<\/span>$help<\/span>)<\/span> <\/span>{<\/span> <\/span>funhelp<\/span> <\/span>}<\/span>
<\/span>if<\/span>(<\/span>$examples<\/span>)<\/span> <\/span>{<\/span> <\/span>funhelp<\/span> <\/span>}<\/span>
<\/span>if<\/span>(<\/span>$full<\/span>)<\/span> <\/span>{<\/span> <\/span>funhelp<\/span> <\/span>}<\/span>
<\/span>if<\/span>(<\/span>$whatif<\/span>)<\/span> <\/span>{<\/span> <\/span>funWhatIf<\/span> <\/span>}<\/span>
<\/span>if<\/span>(!<\/span>$query<\/span>)<\/span> <\/span>{<\/span> “missing parameter” <\/span>;<\/span> <\/span>funhelp<\/span> <\/span>}<\/span>
<\/span>if<\/span>(<\/span>$query<\/span>)<\/span> <\/span>{<\/span> <\/span>funQuery<\/span> <\/span>}<\/span> <\/span> <\/p>\n<\/blockquote>\n

When the LocateDisabledUsers.ps1 script runs, the output appears that is shown in the following image. <\/p>\n

\"Image<\/a> <\/p>\n

Later in my Windows PowerShell 2.0 Best Practices<\/a> book, I decided to update the script, and I used the [adsiSearcher]<\/b> type accelerator. The output is not exactly the same because I do not return the user’s SID. In addition, I display both the disabled user accounts and the accounts that are not disabled, but the concept is basically the same. The FindDisabledUserAccounts.ps1 script is shown here. <\/p>\n

\n

FindDisabledUserAccounts.ps1<\/strong><\/p>\n<\/blockquote>\n

\n
#<\/span>Requires<\/span> <\/span>-Version<\/span> <\/span>2<\/span>.<\/span>0<\/span>
<\/span>$filter<\/span> <\/span>=<\/span> “(&(objectClass=user)(objectCategory=person))”
<\/span>$users<\/span> <\/span>=<\/span> <\/span>([adsiSearcher]<\/span>$Filter<\/span>).findall()<\/span>
<\/span>foreach<\/span>(<\/span>$suser<\/span> <\/span>in<\/span> <\/span>$users<\/span>)<\/span>
<\/span>{<\/span>
“Testing $($suser.properties.item(“”distinguishedname””))”
<\/span>$user<\/span> <\/span>=<\/span> <\/span>[adsi]<\/span>“LDAP:\/\/$($suser.properties.item(“”distinguishedname””))”
<\/span>$uac<\/span>=<\/span>$user<\/span>.psbase.invokeget(<\/span>“useraccountcontrol”<\/span>)<\/span>
<\/span>if<\/span>(<\/span>$uac<\/span> <\/span>-band<\/span> <\/span>0x2)<\/span> 
<\/span>{<\/span> <\/span>write-host<\/span> <\/span>-foregroundcolor<\/span> <\/span>red<\/span> “`t account is disabled” <\/span>}<\/span> 
<\/span>ELSE<\/span> 
<\/span>{<\/span> <\/span>write-host<\/span> <\/span>-foregroundcolor<\/span> <\/span>green<\/span> “`t account is not disabled” <\/span>}<\/span>
<\/span>}<\/span> <\/span>#foreach<\/span> <\/div>\n<\/blockquote>\n

When the FindDisabledUserAccounts.ps1 script runs, the output appears that is shown in the following image.<\/p>\n

\"Image<\/a> <\/p>\n

Now with access to the Active Directory module<\/a> from Windows Server 2008 R2 and with my desktop running Windows 7<\/a> with the RSAT tools<\/a> installed, I can use the Search-ADAccount<\/b> cmdlet. I have not turned this into a script yet because it is basically a single command from a cmdlet. <\/p>\n

For a good introduction to using the Active Directory Domain Services Windows 2008 R2 cmdlets, see Hey, Scripting Guy! What’s Up with Active Directory Domain Services Cmdlets?<\/a><\/p>\n

At some point, I probably will add support for inputting alternative credentials and support for other domains. But for now, it is a single command:<\/p>\n

\n
Search-ADAccount<\/span> <\/span>-AccountDisabled<\/span> <\/span>-UsersOnly<\/span> <\/span>|<\/span> <\/span>Format-Table<\/span> <\/span>name,<\/span> <\/span>sid<\/span> <\/span>-AutoSize<\/span> <\/div>\n<\/blockquote>\n

When the Search-ADAccount<\/b> command runs, the output appears that is shown in the following image.<\/p>\n

\"Image<\/a> <\/p>\n

From a performance standpoint, which of the three different approaches is best? Let us begin with the WMI Win32_UserAccount script. <\/p>\n

\n

See this link for a collection of Hey, Scripting Guy! articles<\/a> that talk about testing the performance of various Windows PowerShell scripts. <\/p>\n<\/blockquote>\n

When I use the Measure-Command cmdlet, it takes 571 milliseconds to return. Keep in mind that my AD is small, and I have two domain controllers on my switched gigabyte network.<\/p>\n

\n
Windows<\/span> <\/span>PowerShell<\/span>
<\/span>Copyright<\/span> <\/span>(C)<\/span> <\/span>2010<\/span> <\/span>Microsoft<\/span> <\/span>Corporation.<\/span> <\/span>All<\/span> <\/span>rights<\/span> <\/span>reserved.<\/span>
<\/span>PS<\/span> <\/span>C:\\><\/span> <\/span>measure-command<\/span> <\/span>{<\/span> <\/span>C:\\data\\Windows2008ResKit\\WS08SecurityResKit\\LocateDisabled<\/span>
<\/span>Users.ps1<\/span> <\/span>-domain<\/span> <\/span>nwtraders<\/span> <\/span>-q<\/span> <\/span>}<\/span>
<\/span>15<\/span> <\/span>disabled<\/span> <\/span>in<\/span> <\/span>the<\/span> <\/span>nwtraders<\/span> <\/span>domain<\/span> <\/span>—<\/span> <\/span>List<\/span> <\/span>follows:<\/span>
<\/span>====================================================<\/span>
<\/span>Days<\/span> <\/span>:<\/span> <\/span>0<\/span>
<\/span>Hours<\/span> <\/span>:<\/span> <\/span>0<\/span>
<\/span>Minutes<\/span> <\/span>:<\/span> <\/span>0<\/span>
<\/span>Seconds<\/span> <\/span>:<\/span> <\/span>0<\/span>
<\/span>Milliseconds<\/span> <\/span>:<\/span> <\/span>571<\/span>
<\/span>Ticks<\/span> <\/span>:<\/span> <\/span>5719349<\/span>
<\/span>TotalDays<\/span> <\/span>:<\/span> <\/span>6<\/span>.61961689814815E-06<\/span>
<\/span>TotalHours<\/span> <\/span>:<\/span> <\/span>0<\/span>.<\/span>000158870805555556<\/span>
<\/span>TotalMinutes<\/span> <\/span>:<\/span> <\/span>0<\/span>.<\/span>00953224833333333<\/span>
<\/span>TotalSeconds<\/span> <\/span>:<\/span> <\/span>0<\/span>.<\/span>5719349<\/span>
<\/span>TotalMilliseconds<\/span> <\/span>:<\/span> <\/span>571<\/span>.<\/span>9349<\/span>
<\/span>PS<\/span> <\/span>C:\\><\/span> <\/div>\n<\/blockquote>\n

I then rebooted my workstation and ran the ADSISearcher script. The reason for rebooting my workstation is to avoid any kind of false performance boosts from ADSI caching. When the script runs, it takes 690 milliseconds to complete. One of the things to keep in mind is that the FindDisabledUserAccounts.ps1 script writes to the Windows PowerShell console, which will increase the amount of time to run the script. <\/p>\n

My workstation has solid-state hard drives, and therefore boots really quickly. In fact, if I turn on my workstation and my laptop at the same time, I can be logged into the domain and have Word started before I am even prompted to type in the Windows BitLocker Drive Encryption PIN for my laptop (a prompt that comes up before the Windows 7 even begins to load). To be perfectly honest, if I were to do the testing on my laptop, I probably would forego the additional reboots. <\/p>\n

\n
PS<\/span> <\/span>C:\\><\/span> <\/span>Measure-Command<\/span> <\/span>{<\/span> <\/span>C:\\data\\ScriptingGuys\\2010\\HSG_8_16_10\\FindDisabledUserAcco<\/span>
<\/span>unts.ps1<\/span> <\/span>}<\/span>
<\/span>account<\/span> <\/span>is<\/span> <\/span>disabled<\/span>
<\/span>account<\/span> <\/span>is<\/span> <\/span>disabled<\/span>
<\/span>account<\/span> <\/span>is<\/span> <\/span>not<\/span> <\/span>disabled<\/span>
<\/span>account<\/span> <\/span>is<\/span> <\/span>not<\/span> <\/span>disabled<\/span>
<\/span>account<\/span> <\/span>is<\/span> <\/span>disabled<\/span>
<\/span>account<\/span> <\/span>is<\/span> <\/span>disabled<\/span>
<\/span>account<\/span> <\/span>is<\/span> <\/span>disabled<\/span>
<\/span>account<\/span> <\/span>is<\/span> <\/span>disabled<\/span>
<\/span>account<\/span> <\/span>is<\/span> <\/span>disabled<\/span>
<\/span>account<\/span> <\/span>is<\/span> <\/span>disabled<\/span>
<\/span>account<\/span> <\/span>is<\/span> <\/span>disabled<\/span>
<\/span>account<\/span> <\/span>is<\/span> <\/span>disabled<\/span>
<\/span>account<\/span> <\/span>is<\/span> <\/span>disabled<\/span>
<\/span>account<\/span> <\/span>is<\/span> <\/span>disabled<\/span>
<\/span>account<\/span> <\/span>is<\/span> <\/span>disabled<\/span>
<\/span>account<\/span> <\/span>is<\/span> <\/span>disabled<\/span>
<\/span>account<\/span> <\/span>is<\/span> <\/span>disabled<\/span>
<\/span>account<\/span> <\/span>is<\/span> <\/span>not<\/span> <\/span>disabled<\/span>
<\/span>account<\/span> <\/span>is<\/span> <\/span>not<\/span> <\/span>disabled<\/span>
<\/span>account<\/span> <\/span>is<\/span> <\/span>not<\/span> <\/span>disabled<\/span>
<\/span>account<\/span> <\/span>is<\/span> <\/span>not<\/span> <\/span>disabled<\/span>
<\/span>account<\/span> <\/span>is<\/span> <\/span>not<\/span> <\/span>disabled<\/span>
<\/span>account<\/span> <\/span>is<\/span> <\/span>not<\/span> <\/span>disabled<\/span>
<\/span>account<\/span> <\/span>is<\/span> <\/span>not<\/span> <\/span>disabled<\/span>
<\/span>account<\/span> <\/span>is<\/span> <\/span>not<\/span> <\/span>disabled<\/span>
<\/span>Days<\/span> <\/span>:<\/span> <\/span>0<\/span>
<\/span>Hours<\/span> <\/span>:<\/span> <\/span>0<\/span>
<\/span>Minutes<\/span> <\/span>:<\/span> <\/span>0<\/span>
<\/span>Seconds<\/span> <\/span>:<\/span> <\/span>0<\/span>
<\/span>Milliseconds<\/span> <\/span>:<\/span> <\/span>690<\/span>
<\/span>Ticks<\/span> <\/span>:<\/span> <\/span>6904643<\/span>
<\/span>TotalDays<\/span> <\/span>:<\/span> <\/span>7<\/span>.9914849537037E-06<\/span>
<\/span>TotalHours<\/span> <\/span>:<\/span> <\/span>0<\/span>.<\/span>000191795638888889<\/span>
<\/span>TotalMinutes<\/span> <\/span>:<\/span> <\/span>0<\/span>.<\/span>0115077383333333<\/span>
<\/span>TotalSeconds<\/span> <\/span>:<\/span> <\/span>0<\/span>.<\/span>6904643<\/span>
<\/span>TotalMilliseconds<\/span> <\/span>:<\/span> <\/span>690<\/span>.<\/span>4643<\/span>
<\/span>PS<\/span> <\/span>C:\\><\/span> <\/div>\n<\/blockquote>\n

I reboot my workstation one more time, and after loading the Active Directory module, I run the Search-ADAccount<\/b> cmdlet command and use the Measure-Command<\/b> cmdlet to time the operation. The results show that it took 81 milliseconds to complete, making it the fastest of the three commands:<\/p>\n

\n

Windows<\/span> <\/span>PowerShell<\/span>
<\/span>Copyright<\/span> <\/span>(C)<\/span> <\/span>2010<\/span> <\/span>Microsoft<\/span> <\/span>Corporation.<\/span> <\/span>All<\/span> <\/span>rights<\/span> <\/span>reserved.<\/span>
<\/span>PS<\/span> <\/span>C:\\><\/span> <\/span>Import-Module<\/span> <\/span>ac<\/span>*<\/span>
<\/span>PS<\/span> <\/span>C:\\><\/span> <\/span>measure-command<\/span>{Search-ADAccount<\/span> <\/span>-AccountDisabled<\/span> <\/span>-UsersOnly<\/span> <\/span>|<\/span> <\/span>Format-Table<\/span>
<\/span>name,<\/span> <\/span>sid<\/span> <\/span>-AutoSize<\/span> <\/span>}<\/span>
<\/span>Days<\/span> <\/span>:<\/span> <\/span>0<\/span>
<\/span>Hours<\/span> <\/span>:<\/span> <\/span>0<\/span>
<\/span>Minutes<\/span> <\/span>:<\/span> <\/span>0<\/span>
<\/span>Seconds<\/span> <\/span>:<\/span> <\/span>0<\/span>
<\/span>Milliseconds<\/span> <\/span>:<\/span> <\/span>81<\/span>
<\/span>Ticks<\/span> <\/span>:<\/span> <\/span>819660<\/span>
<\/span>TotalDays<\/span> <\/span>:<\/span> <\/span>9<\/span>.48680555555556E-07<\/span>
<\/span>TotalHours<\/span> <\/span>:<\/span> <\/span>2<\/span>.27683333333333E-05<\/span>
<\/span>TotalMinutes<\/span> <\/span>:<\/span> <\/span>0<\/span>.<\/span>0013661<\/span>
<\/span>TotalSeconds<\/span> <\/span>:<\/span> <\/span>0<\/span>.<\/span>081966<\/span>
<\/span>TotalMilliseconds<\/span> <\/span>:<\/span> <\/span>81<\/span>.<\/span>966<\/span> <\/p>\n<\/blockquote>\n

What does all this tell me? For my environment, any of the three approaches work. And all are virtually the same speed. Keep in mind when using the Measure-Command<\/b> cmdlet that you should be really careful making judgments based upon milliseconds—it simply is not that accurate. If the results are several seconds apart, you have a guideline to go on. But milliseconds? Dude<\/a>, the antivirus program can kick in and start a scan, or a process can decide to start. Anything can cause a time skew of a few hundred milliseconds. <\/p>\n

In addition, you may have other requirements that will dictate which approach you use. The following table summarizes the three different techniques.<\/p>\n\n\n\n\n\n\n
\n

Approach<\/b><\/p>\n<\/td>\n

\n

Use<\/b><\/p>\n<\/td>\n<\/tr>\n

\n

WMI Win32_UserAccount<\/p>\n<\/td>\n

\n

VBScript, Windows PowerShell 1.0, Windows PowerShell 2.0. If VBScript, then Windows 2000 and later. If Windows PowerShell, then Windows XP<\/a> and later.<\/p>\n<\/td>\n<\/tr>\n

\n

ADSISearcher<\/p>\n<\/td>\n

\n

Windows PowerShell 2.0, Windows XP, and later on client.<\/p>\n<\/td>\n<\/tr>\n

\n

Search-ADAccount<\/p>\n<\/td>\n

\n

Windows PowerShell 2.0, Windows 7 with RSAT tools installed, Windows Server 2008 R2 domain controller. <\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

EJ, that is all there is to using Windows PowerShell to search for disabled user accounts. User Management Week will continue tomorrow when we will talk about changing a user’s password. <\/p>\n

We invite you follow us on Twitter<\/a> and Facebook<\/a>. If you have any questions, send email to us at scripter@microsoft.com<\/a>, or post your questions on the Official Scripting Guys Forum.<\/a>. See you tomorrow. Until then, peace.<\/p>\n

 <\/p>\n

Ed Wilson and Craig Liebendorfer, Scripting Guys<\/b><\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

  Summary: The Scripting Guys discuss three different approaches to finding disabled user accounts in Active Directory Domain Services by using Windows PowerShell.   Hey, Scripting Guy! I would like to use Windows PowerShell to search Active Directory Domain Services (AD DS) for user accounts that are disabled. I had a VBScript script I had […]<\/p>\n","protected":false},"author":595,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[7,3,8,20,45],"class_list":["post-17411","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-active-directory","tag-scripting-guy","tag-searching-active-directory","tag-user-accounts","tag-windows-powershell"],"acf":[],"blog_post_summary":"

  Summary: The Scripting Guys discuss three different approaches to finding disabled user accounts in Active Directory Domain Services by using Windows PowerShell.   Hey, Scripting Guy! I would like to use Windows PowerShell to search Active Directory Domain Services (AD DS) for user accounts that are disabled. I had a VBScript script I had […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/17411","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=17411"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/17411\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=17411"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=17411"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=17411"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}