I have a long list of users to disable every week and I am trying to figure out how can I write an LDIF script to check if users in AD are disabled and if not to disable them and move them to another OU.

Environment: Windows Server 2008 R2

Thank you


This can be done with PowerShell.

The general process would be something like this:

  • Read the file line by line with the usernames you want to disable, and loop over the usernames
  • Use Get-ADUser$username to get the AD object for the users one by one
  • Check the objects you get, if they are disabled. You can use the Enabled property on the ADUser for this.
  • If they need disabling, use the Disable-ADAccount and Move-ADObject cmdlets to accomplish that.

You may even be able to do this as a oneliner if you really wanted to. Something like:

Get-Content userstodisable.txt | Get-ADUser | Where Enabled -eq True | Disable-ADAccount -PassThru | Move-ADObject -TargetPath OU=Disabled,DC=corp,DC=example,DC=com

Feel free to hack around with this until you get it right.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.