Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a process by which we disable an Active Directory user account when they are terminated. The Exchange 2007 mailbox is left and the forwarding is set to the users manager. I need to run a script periodically that will pull a list of currently active mailboxes with the corresponding AD account disabled. I have no experience with any type of scripting but believe it can be done based on other things i've read. I did some searching but came up empty handed with this specific requirement. Thank you.

Server 2003R2, Exchange 2007, AD

To be clear I am not asking for anyone to write this for me, just some links possibly to push me in the right direction.

share|improve this question
Define currently active mailboxes? –  Izzy Sep 23 '10 at 15:45
The mailbox has not been flagged for removal via Disable Mailbox or Remove Mailbox. –  David Yenglin Sep 23 '10 at 17:01
add comment

4 Answers

up vote 1 down vote accepted

You can use standard LDAP calls through a language like PHP or use AD-specific calls from a Microsoft product (C# with the DirectoryServices library, for example). I don't have Exchange, so I don't know what the raw attributes for mailboxes are, but to see whether an account is disabled, you would check the "userAccountControl" attribute for each user, and then interpret the numeric flags to see whether the account is disabled ( the list of flags can be seen here: http://support.microsoft.com/kb/305144 )

The basic process for the script would be:

  1. Bind to the Active Directory using either LDAP (PHP, perl, etc.) or DirectoryService (Visual Basic, C#).

  2. Do a search for all user objects (objects with a SamAccountType of 30000000 in hex) that are disabled (objects with a hex userAccountControl value containing '2' in their integer form)

  3. Loop through the resulting objects and make a call to determine which ones have mailboxes that are active (again, I don't use Exchange so I don't have a good answer here).

  4. Print out or write to file some appropriate attributes every time you get a hit in #3 (sAMAccountName, dn, and cn would be good places to start) along with perhaps a date stamp for the entire report.

share|improve this answer
I ended up using the techniques described here using vbs. I also used bits from Phils answer and ultimately Massimos answer gave me the idea to create the quickest solution to my problem. This is marked as answer because it was the first answer which worked, allthough not the easiest to implement as the info in Phil and Massimos answers combined to be the quickest/easiest. –  David Yenglin Sep 23 '10 at 19:57
add comment

There should be a tool installed with your Exchange called LDIFDE. With this tool you can import or export stuff from your ActiveDirectory. If you need a file containing all disabled useraccounts just open a commandline and type:

LDIFDE -u -f myexport.ldif -r "(&(objectCategory=person)(userAccountControl=514))"

If the exported data is a bit too much, you can limit that with various parameters. If you only want the names of the disabled accounts, just try

LDIFDE -u -f myexport.ldif -r "(&(objectCategory=person)(userAccountControl=514))" -l "dn"

Best regards, Phil.

share|improve this answer
Thanks Phil this was very useful and i ended up using parts of this in my vbs solution as well as the LDIFDE solution to my problem. –  David Yenglin Sep 23 '10 at 19:57
add comment

This should help: http://msexchangetips.blogspot.com/2007/06/exchange-find-disabled-accounts-with.html

I'm sure there is a way to do this using PowerShell, but I don't have an Exchange server at hand at this moment...

share|improve this answer
The notes about using msExchHideFromAddressLists in the link you provided ended up being what i think is the simplest solution however as you can see above i chose Johnnies answer for the reasons given. –  David Yenglin Sep 23 '10 at 19:59
add comment

To share what i ended up using as my final solution i'd like to elaborate in addition to what comments i left in each persons answer.

I decided to start using the Hide from Exchange address lists attribute when an employee is terminated.

So then using LDIFDE with a combination of the info provided by Phil and from Massimo's link here is what i did.

LDIFDE -f c:\disabledusersmailbox.txt -r "(&(UserAccountControl=514)(objectClass=User)(msExchHideFromAddressLists=TRUE))" -l "dn"
share|improve this answer
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.