Export list of disable AD accounts 3

[billybarty]

How can I get a list of disabled accounts from AD Domain Users group?

 

[unclerico]

I would say that there are a few fella's in here that could write a better script, but this should at least point you in the right direction. It queries your entire domain for user objects and if they are disabled it prints it to a text file located at c:\temp:

Dim fso, f
Dim conn
Dim rs
Dim provider
Dim strSql


Set conn = CreateObject("ADODB.Connection")
Set fso = CreateObject("Scripting.FileSystemObject")
Set f = fso.CreateTextFile("C:\Temp\Enabled.txt")

provider = "ADsDSOObject"

With conn
	.Provider = provider
	.Open "Active Directory Provider"
End With

strSql = "SELECT sn, givenname, adspath, useraccountcontrol FROM 'LDAP://DC=[b]YOUR DOMAIN[/b],DC=com' WHERE objectclass = 'user' AND useraccountcontrol = 514 ORDER BY sn"

set rs = conn.execute(strSql)

Do until rs.EOF

	f.WriteLine rs("sn") & ", " & rs("givenname") & " - " & rs("useraccountcontrol") & "   -   " & rs("adspath")

	rs.MoveNext

Loop

f.Close


msgbox "Done"


Set conn = Nothing
Set rs = Nothing
Set fso = Nothing

Hopefully it works for you.

 

[swabs]

you can get that information from dsquery

dsquery user -disabled

 

[billybarty]

Thanks for your help, the dsquery options are a big help.

 

[unclerico]

now that's what I'm talking about...my code is what, 30+ lines and swabs comes back with a 3 word solution...beautifule

 

[ntinlin]

If you want to do it in a GUI do a Find in ADUC and change to Common Queries. Then tick the disabled accounts box.

Neill

 

[billybarty]

Awesome

 

[billybarty]

Using these methods gives me the disabled account in the domain. I need to get the disabled from the domain users group only. The dsquery I think only works on OU's.

 

[swabs]

do you really have many accounts that are not part of the "domain users" ou?

 

[billybarty]

Yes, we have some accounts that were created for access to a web portal we host and they are removed from the domain users group upon creation. I modified the script above to search the Domain Users group for our domain and it runs successfully but generates an empty text file called Enabled.txt. If I missed some quotes or something should it give me an error the way it is written or complete with no errors?