Wednesday, 27 May 2015

Export Inactive AD Users to CSV using PowerShell

One of the most common task in Active Directory is finding inactive AD users on regular basis to disable or delete staled accounts from Active Directory. In powershell, we can use the cmdlet Get-ADUser to get set of user details. We can use either SQL like filter or LDAP filter with lastLogonTimeStamp attribute to get inactive users.

Find and List Inactive AD Users

We can find all inactive AD users for the specified time period by comparing user's lastlogontimestamp value. The below powershell script find and list AD users who are not logged in last 90 days, it also filters disabled users and get only enabled inactive users.
Import-Module ActiveDirectory
# No of days - Get AD users who are no logged in last 90 days
$DaysInactive = 90
$time = (Get-Date).Adddays(-($DaysInactive))
Get-ADUser -Filter {LastLogonTimeStamp -lt $time -and enabled -eq $true} -Properties *| 

Select-Object Name, @{Name="LastLogonTimeStamp";
Expression={[DateTime]::FromFileTime($_.lastLogonTimestamp).ToString()}}

Export Inactive AD Users to CSV file

We can generate and export Active Directory inactive users report to CSV file using Powershell cmdlets Get-ADUser and Export-CSV. You can add more attributes in Select-Object field to export more AD attributes of inactive users.
Import-Module ActiveDirectory
# No of days - Get AD users who are no logged in last 90 days
$DaysInactive = 90  
$time = (Get-Date).Adddays(-($DaysInactive)) 
Get-ADUser -Filter {LastLogonTimeStamp -lt $time -and enabled -eq $true} -Properties * | 

Select-Object Name,Mail,DistinguishedName, @{Name="LastLogonTimeStamp"; 
Expression={[DateTime]::FromFileTime($_.lastLogonTimestamp).ToString()}} |
# Export Inactive Users Report to CSV file 
Export-CSV "C:\\InactiveADUsers.csv" -NoTypeInformation -Encoding UTF8

Export Inactive AD Users from Specific OU

We can set target OU scope by using the parameter SearchBase. The following powershell script select all the Inactive AD users from the Organization Unit 'TestOU' and export it to CSV file.
Import-Module ActiveDirectory
# No of days - Get AD users who are no logged in last 90 days
$DaysInactive = 90  
$time = (Get-Date).Adddays(-($DaysInactive)) 
Get-ADUser -SearchBase "OU=TestOU,DC=TestDomain,DC=Local"`
-Filter {LastLogonTimeStamp -lt $time -and enabled -eq $true} -Properties * | 

Select-Object Name,Mail,DistinguishedName, @{Name="LastLogonTimeStamp"; 
Expression={[DateTime]::FromFileTime($_.lastLogonTimestamp).ToString()}} | 
Export-CSV "C:\\InactiveADUsers.csv" -NoTypeInformation -Encoding UTF8

CSV output of Inactive AD Users Report

Powershell - Export Inactive Active Directory Users to CSV

Advertisements
Advertisements

No comments:

Post a Comment