Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When an employee leaves our organizations for any reason, currently we disable their AD account but do not immediately delete it. However, the problem with this is that these users still show up in the Global Address List.

I'm sure there is a PowerShell script to remove them but I would like to make things more streamlined.

I'm hoping somebody here might be able to provide a better way to go about disabling users which will automatically remove them from the GAL in the process.

So far I can think of two potential solutions.

  1. Create a script that runs a PS script every hour that will remove disabled users from the GAL.

  2. Use a PS command that will simultaneously disable a user and remove them from the GAL.

Option 2 is likely the better option so if somebody could assist with that, I would greatly appreciate it.

Thanks in advance.

share|improve this question
up vote 6 down vote accepted

No need to re-invent the wheel, found this elegant solution over at

# usage: Disable-User [accountname] [enable/disable]

function get-dn ($SAMName)    {
    $root = [ADSI]''
     $searcher = new-object System.DirectoryServices.DirectorySearcher($root)
    $searcher.filter = "(&(objectClass=user)(sAMAccountName= $SAMName))"
    $user = $searcher.findall()

    if ($user.count -gt 1)      {     
            $count = 0
                foreach($i in $user)            { 
            write-host $count ": " $i.path 
                    $count = $count + 1

            $selection = Read-Host "Please select item: "
        return $user[$selection].path

          }      else      { 
          return $user[0].path

$Name = $args[0]
$status = $args[1]
$path = get-dn $Name

if ($path -ne $null)    {

    "'" + $path + "'"  
    if ($status -match "enable")     {
        # Enable the account
        $account.psbase.invokeset("AccountDisabled", "False")
        Set-Mailbox "$Name" -HiddenFromAddressListsEnabled $False
    }    else    {
        # Disable the account
        $account.psbase.invokeset("AccountDisabled", "True")
        Set-Mailbox "$Name" -HiddenFromAddressListsEnabled $True
}    else    {
    write-host "No user account found!" -foregroundcolor white -backgroundcolor red

Save it as Disable-User.ps1 and run .\Disable-User.ps1 SAMaccountname disable

share|improve this answer
Awesome, thanks man. I'll give it a try and if it works, award the answer! – Windows Ninja Mar 8 '12 at 17:47
Works like a dream, thanks again for pointing me in the right direction. – Windows Ninja Mar 8 '12 at 18:00
NP. Thought about the Quest solution as proposed by smassey, but for the sake of portability I believe this is better – Mathias R. Jessen Mar 8 '12 at 18:22
Upvote. Hide all of your disabled users from the GAL. – Tatas Mar 8 '12 at 18:43

There is an easier solution than the one above and can be accomplished in two lines when using the Quest AD PowerShell Commandlets in the Exchange Management Console.

[string]$username = $(throw "A user ID is required.") #throw exception if no value provided

Disable-QADUser -Identity $username -service "dc.domain.local:389"
Set-Mailbox  -identity "domain\$username" -HiddenFromAddressListsEnabled $true -DomainController "dc.domain.local"
share|improve this answer
Powershell is the preferred method. – Tatas Mar 8 '12 at 18:43

There's a much easier way:

  1. Go to EMC > user mailbox > properties
  2. In the general tab you will see a check box hide from exchange address list, check this box.
  3. click apply

No one will be able to see that user in GAL after that.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.