Just want to make sure what you are looking for here. You truly mean account disabled? the UserAccountControl flag? This flag does not include a date/time stamp as to when the account was disabled. To get that info you would have to scan the security event logs of all your domain controllers. I think that would be event ID 642.
Just want to see if that is really what you are looking to do. Christopher Bodnar Technical Support III, Distributed Systems Service Delivery - Intel Services Tel 610-807-6459 3900 Burgess Place, Bethlehem, PA 18017 [email protected] The Guardian Life Insurance Company of America www.guardianlife.com From: "Kelsey, John" <[email protected]> To: "NT System Admin Issues" <[email protected]> Date: 01/25/2012 10:58 AM Subject: Powershell Script Anybody have a down and dirty Powershell script that shows all AD accounts disabled within the last x amount of hours? Thanks all! ************************************* John C. Kelsey DuBois Regional Medical Center (: 814.375.3073 2 : 814.375.4005 *: [email protected] ************************************* This email and any attached files are confidential and intended solely for the intended recipient(s). If you are not the named recipient you should not read, distribute, copy or alter this email. Any views or opinions expressed in this email are those of the author and do not represent those of the company. Warning: Although precautions have been taken to make sure no viruses are present in this email, the company cannot accept responsibility for any loss or damage that arise from the use of this email or attachments. ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected] with the body: unsubscribe ntsysadmin ----------------------------------------- This message, and any attachments to it, may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, you are notified that any use, dissemination, distribution, copying, or communication of this message is strictly prohibited. If you have received this message in error, please notify the sender immediately by return e-mail and delete the message and any attachments. Thank you. ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected] with the body: unsubscribe ntsysadmin
<<image/jpeg>>
