Need help creating Powershell to find AD users

marcchevez · 2024-01-03T18:17:16.000Z

I need to look up a list of AD users find the Username of the account, Disable the account and move it to the disabled users list.

If it doesnt exist I would to know that as well.

I have a CSV file that has the list of AD user with two columns, First Name, and Last Name.

Thanks for the help ahead of time. This is what I have so far, but it doesnt pull from a CSV file. I have to find the Account name first and add them to this $users variable.

$Users = “testuser1”, “testuser2”
Foreach ($User in $Users) {
$SamAccountName = $User
if (!(Get-ADUser -Filter { (SamAccountName -eq $SamAccountName) })) {
#if user does not exist, give a warning
Write-Warning “User account with username $SamAccountName does NOT exist in Active Directory”
}
elseif (Get-ADUser -Filter { (SamAccountName -eq $SamAccountName) -and (Enabled -eq $False) }) {
#If user exists but in disabled state, give a warning
Write-Warning “A user account with username $SamAccountName has already been DISABLED in Active Directory.”
}
else {
Get-ADUser -Identity $SamAccountName | Disable-ADAccount
Write-Output “$($SamAccountName) has now been disabled”
}
}

Neally · 2024-01-03T18:19:45.000Z

If you post code, please use the ‘Insert Code’ button. Please and thank you!

PLEASE READ BEFORE POSTING! Read if you're new to the PowerShell forum! Programming & Development

Hi, and welcome to the PowerShell forum! Don’t apologize for being a “noob” or “newbie” or “n00b.” There’s just no need – nobody will think you’re stupid, and the forums are all about asking questions. Just ask! Use a descriptive subject. Don't say "Need help" or "PowerShell Help", actually summarize what the problem is. It helps the rest of us keep track of which problem is which. Don’t post massive scripts. We’re all volunteers and we don’t have time to read all that, nor will we copy, past…

https://community.spiceworks.com/how_to/187367-write-better-powershell-scripts

Neally Bot

Neally · 2024-01-03T18:21:56.000Z

MSC:

I have a CSV file that has the list of AD user with two columns, First Name, and Last Name.

first/last is kinda yucky, you have nothing with UPN/samaccountname/employee ID, anything that’s unique?

We have like a dozen ‘Mike Smith’ so going by name is really crappy.

marcchevez · 2024-01-03T18:30:04.000Z

Problem is we have mutilple domains, I get a list of usernames that do not match the usernames in the other domains that I manage.

This list of users gives me the first\Last\username for Domain1. I have to look up those First\Last names and match them to a user in Domain2,3,4,5,6,7,8,ect.

Thats why I was looking for a script that would, take a first and last name and output the username it finds for each. Then take that list and check if the account is enabled or disabled and report it to a CSV.

Neally · 2024-01-03T18:37:45.000Z

MSC:

Problem is we have mutilple domains, I get a list of usernames that do not match the usernames in the other domains that I manage.

This list of users gives me the first\Last\username for Domain1. I have to look up those First\Last names and match them to a user in Domain2,3,4,5,6,7,8,ect.

Thats why I was looking for a script that would, take a first and last name and output the username it finds for each. Then take that list and check if the account is enabled or disabled and report it to a CSV.

you can do something like that, just gotta add another foreach for each domain.

$data = import-csv "input.csv"
$DC   = (Get-ADDomainController).name

foreach($user in $data){
    $AD = $null
    $AD = Get-ADUser -Filter "Givenname -eq '$($user.firstname)' -and Surname -eq '$($user.lastname)'" -Server $DC
    
    if($AD -and $AD.Enabled -eq $TRUE){
        try{
            $AD | Disable-ADAccount -Server $DC -ErrorAction Stop
            Write-Verbose "Account '$($ad.SamAccountName)' disabled" -Verbose
        }catch{
            $error[0].Exception.Message
        }
    }
    else{
        if($AD -and $AD.Enabled -eq $FALSE){
            Write-Verbose "Account '$($ad.SamAccountName)' already disabled" -Verbose
        }
        else{
            Write-Verbose "No match account found for '$($user.firstname) $($user.lastname)'" -Verbose
        }
    }
}

marcchevez · 2024-01-03T19:16:39.000Z

VERBOSE: No match account found for ’ ’
Get-ADUser : The search filter cannot be recognized
At line:6 char:11

$AD = Get-ADUser -Filter "Givenname -eq ‘$($user.firstname)’ -and Surname -e …
CategoryInfo : NotSpecified: ( [Get-ADUser], ADException
FullyQualifiedErrorId : ActiveDirectoryServer:8254,Microsoft.ActiveDirectory.Management.Commands.GetADUser

Getting this error, My CSV file has two columns, Firstname and Lastname. Nor sure what is going on.

Neally · 2024-01-03T19:26:08.000Z

MSC:

VERBOSE: No match account found for ’ ’
Get-ADUser : The search filter cannot be recognized
At line:6 char:11
$AD = Get-ADUser -Filter "Givenname -eq ‘$($user.firstname)’ -and Surname -e …
CategoryInfo : NotSpecified: ( [Get-ADUser], ADException

FullyQualifiedErrorId : ActiveDirectoryServer:8254,Microsoft.ActiveDirectory.Management.Commands.GetADUser
Getting this error, My CSV file has two columns, Firstname and Lastname. Nor sure what is going on.

my sample csv looks like so: do you have a whitespace between ‘first name’ ?

"FirstName","LastName"
"neally","neally"
"bob","mike"

marcchevez · 2024-01-03T19:40:25.000Z

that was it, thanks a ton!

PatrickFarrell · 2024-01-03T19:49:13.000Z

Glad you got it solved and can I say it’s great to see someone asking for help saying this is what I need, here’s where I’m stuck, and here’s what I have done so far.

Kudos.