アクティブでないADUserクエリとADGroup操作で問題が発生しました

Question

特定のOUのADUsersにクエリを（最初に）試みています。 90日間アクティブでないものを特定する。グループメンバーシップを文書化する。 Description欄にx-dateの時点でアカウントが無効であることを書き留めます。識別されたアカウントを無効にする。無効なアカウントを「パーキング」OUに移動します。

私はGistにもメモを書きましたが、グループメンバーシップ作品の作業に役立つことに感謝します。

https://gist.github.com/rsmith7712/fdfe025d989508102044fdbbf5d3b9a8

Answer 1

私はこれをテストしていませんが、それは

# http://stackoverflow.com/questions/37577369/inactive-aduser-query-and-adgroup-manipulation-encountering-issues 

# Import Modules Needed 
Import-Module ActiveDirectory 

# Output results to CSV file 
$LogFile = "C:\ZombieAcct_90dayRpt_n_Move.csv" 

# Today's Date 
$today = get-date -uformat "%Y/%m/%d" 

# Date to search by 
$xDays = (get-date).AddDays(-90) 

# Expiration date 
$expire = (get-date).AddDays(-1) 

# Date disabled description variable 
$userDesc = "Disabled Inactive" + " - " + $today 

# Sets the OU to do the base search for all user accounts, change as required 
$SearchBase = "OU=DEFINE,OU=DEFINE,OU=DEFINE,DC=DEFINE,DC=com" 

# Sets the OU where accounts will be MOVED TO, change as required 
$ParkingOU = "OU=30Days, OU=Disabled Accounts, OU=Domain Services, DC=DEFINE, DC=com" 

# Pull all inactive users older than 90-days from a specified OU 
$Users = Get-ADUser -SearchBase $SearchBase -Properties memberof, LastLogonDate, PasswordLastSet, PasswordNeverExpires, WhenCreated, DisplayName -Filter { 
    (LastLogonDate -notlike '*' -OR LastLogonDate -le $xDays) 
    -AND (PasswordLastSet -le $xDays) 
    -AND (Enabled -eq $True) 
    -AND (PasswordNeverExpires -eq $false) 
    -AND (WhenCreated -le $xDays) 
} | ForEach-Object { 
    Set-ADUser $_ -AccountExpirationDate $expire -Description $userdesc -WhatIf 
    Move-ADObject $_ -TargetPath $ParkingOU -WhatIf 
    $_ | select DisplayName, Name, SAMaccountName, PasswordExpired, PasswordNeverExpires, WhenCreated, PasswordLastSet, LastLogonDate, @{n='Groups';e={(($_.memberof | Get-ADGroup).Name) -join '; '}} 
} 

$Users | Export-Csv $LogFile -NoTypeInformation 

start $LogFile 

Answer 2

@AnthonyStringerあなたの問題を解決する一つの方法かもしれない - あなたのスクリプトを取り、環境のためにそれを微調整。ここに最終的なスクリプトがあります。ありがとうございます。

まだ問題があります： - ADUser Group Membershipsを収集することは、$ xDays変数を満たしているADUserアカウントにのみクエリを実行できるのではなく、指定された$ SearchBase OU内のすべてのユーザーに適用されます。

デベロッパーはGistで作業を続けますが、この質問は終了します。 https://gist.github.com/rsmith7712/fdfe025d989508102044fdbbf5d3b9a8

# Inactive_ADUserRpt_n_Move_v3.ps1 
# 
# Git- rsmith7712, 2016-05-20 
# 
# Contributors: 
# @EricRocconi, @AnthonyStringer, 
# 
# Purpose of Script: 
# 1. Query ADUsers in a specific OU and identify those that have been inactive for 90-days or more 
# 2. Document their Group Memberships 
# 3. Make a note in the user's Description field that the 'Account Disabled as of yyyy/mm/dd' 
# 4. Disable user's account 
# 5. Move the disabled user's account to a 'Parking' OU 
# 
# ############################################# 
# 
# Current Issues: 
# 1. Unable to add in the functionality of querying and adding the results of Get-ADGroup and MemberOf to the original query 
# 
# --> Need to add ability to constrain query to $xDays variable (IF unable to include results in Inactive Users query) 
# 
# ############################################# 
# 


# Import Modules Needed 
Import-Module ActiveDirectory 

# Output results to CSV file 
$LogFile = "C:\Inactive_ADUserRpt_n_Move_v3_USERS.csv" 

# Today's Date 
$today = get-date -uformat "%Y/%m/%d" 

# Date to search by 
#$xDays = (get-date).AddDays(-90) 
#$xDays = (get-date).AddDays(-120) 
$xDays = (get-date).AddDays(-365) 

# Expiration date 
$expire = (get-date).AddDays(-1) 

# Date disabled description variable 
$userDesc = "Disabled Inactive" + " - " + $today + " - " + "Moved From OU" + " - " + $SearchBase 

# Sets the OU to do the base search for all user accounts, change as required 
#$SearchBase = "OU=MIT, OU=Service Accounts, OU=Domain Services, DC=Domain, DC=com" 
$SearchBase = "OU=Laptop, OU=IS, OU=Corporate Computers, DC=Domain, DC=com" 


# Sets the OU where accounts will be MOVED TO, change as required 
$ParkingOU = "OU=30Days, OU=Disabled Accounts, OU=Domain Services, DC=Domain, DC=com" 


# Document Group Memberships and export to CSV 
# -- This will generate a CSV for ALL users in OU regardless of account status 
# --> Need to add ability to constrain query to $xDays variable 

Get-ADUser -SearchBase $SearchBase -Filter * -Properties DisplayName, MemberOf | % { 
    New-Object PSObject -Property @{ 
    UserName = $_.DisplayName 
    Groups = ($_.MemberOf | Get-ADGroup | Select -ExpandProperty Name) -join "," 
    } 
} | Select UserName, Groups | Export-Csv C:\ADUser_GroupMembership_Rpt.csv -NTI 


# Pull all inactive users older than 90-days from a specified OU 
$Users = Get-ADUser -SearchBase $SearchBase -Properties memberof, PasswordNeverExpires, WhenCreated, PasswordLastSet, LastLogonDate -Filter { 
    (LastLogonDate -notlike '*' -OR LastLogonDate -le $xDays) 
    -AND (PasswordLastSet -le $xDays) 
    -AND (Enabled -eq $True) 
    -AND (PasswordNeverExpires -eq $false) 
    -AND (WhenCreated -le $xDays) 
} | ForEach-Object { 
    Set-ADUser $_ -AccountExpirationDate $expire -Description $userdesc -WhatIf 
    Move-ADObject $_ -TargetPath $ParkingOU -WhatIf 
    $_ | select Name, SamAccountName, PasswordExpired, PasswordNeverExpires, WhenCreated, PasswordLastSet, LastLogonDate, @{n='Groups';e={(($_.memberof | Get-ADGroup).Name) -join '; '}} 
} 

$Users | Where-Object {$_} | Export-Csv $LogFile -NoTypeInformation 

#start $LogFile