Powershell - check if all users in a specific OU are disabled, disable if not

Question

I tried to search for it but I didn't find anything. Could someone help me out with an example of a script that would do this?

Solution 1

Something like this:

Get-ADUser -Filter * -SearchBase "ou=TheOU,dc=contoso,dc=com" | Disable-ADAccount

You might need to upgrade your Powershell version if it doesn't have the commands.

---

Try/Catch example:

$users = Get-ADUser -Filter * -SearchBase "ou=TheOU,dc=contoso,dc=com"    

ForEach ($user in $users) {
    Try {
        Disable-Account
    }
    Catch {
        Write-Output "$($user) is already disabled."
    }
    Finally {
        # Cleanup tasks, etc.
    }
}

Solution 2

To avoid disabling disabled accounts you can filter them out:

Get-ADUser -Filter {Enabled -eq $true} -SearchBase "ou=TheOU,dc=contoso,dc=com" `
| Disable-ADAccount

Comments

[Vasili Syrakis]

As far as I know you can't lock them, but you can disable them.

[Npv23g]

@VasiliSyrakis i meant disable..

[software is fun]

the script disables every account and DOES check to see which accounts are disabled