You will not be able to pull that info from AD. The best you could do is search for all disabled users and then the modifytimestamp attribute
something like this with quest ad cmdlets get-qaduser -disabled -modifiedafter 1/24/2012 or Get-QADUser -Disabled -ModifiedAfter (get-date).adddays(-1) a better way would be to add something to an attribute when the user is disabled like the description and key off of that On Wed, Jan 25, 2012 at 10:33 AM, Kelsey, John <[email protected]> wrote: > Anybody have a down and dirty Powershell script that shows all AD accounts > disabled within the last x amount of hours?**** > > ** ** > > Thanks all!**** > > ** ** > > ************************************* > *John C. Kelsey > *DuBois Regional Medical Center > (: 814.375.3073 > 2 : 814.375.4005 > *: [email protected] > ***************************************** > > ** ** > > This email and any attached files are confidential and intended solely for > the intended recipient(s). If you are not the named recipient you should > not read, distribute, copy or alter this email. Any views or opinions > expressed in this email are those of the author and do not represent those > of the company. Warning: Although precautions have been taken to make sure > no viruses are present in this email, the company cannot accept > responsibility for any loss or damage that arise from the use of this email > or attachments. > > ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ > ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ > > --- > To manage subscriptions click here: > http://lyris.sunbelt-software.com/read/my_forums/ > or send an email to [email protected] > with the body: unsubscribe ntsysadmin > ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected] with the body: unsubscribe ntsysadmin
