Query AD when an account was disabled

[AdobeLDAP]

I want to write a VBScript to query AD and get all the disabled accounts and their disabled date. Currently, I can get a list of disabled accounts, but I am not sure how to get the disabled date. Does anyone have any idea how to do this?
Thanks!

 

[WhoKilledKenny]

The syntax of the property for "disabled" returns a boolean value, which is either TRUE or FALSE. To find the date the object was disabled you would have to comb the Security Logs on the DCs for the Event ID which correlates with disabling an account. Another attribute to look at, that will return a "date/Time" value is the LastLogonTime attribute. Be aware that this property is not replicated to all domain controllers. You will have to run your VBscript against each DC in your organization. At least it will give you the date and time the user last accessed your domain.

Jesse Hamrick

http://www.powershellpro.com