Hello looking for help with this script. It appears to work as expected, gets the expired users, disables the account and moves them to the correct OU. What I can't figure out is why I keep getting the same results each time it runs. I've verified the activity
from a previous run, however, after running the script again it still gives me the same list of users that are no longer in the OU, as they have been moved to "disabled".
$today = Get-Date -UFormat "%m-%d-%Y"
# Setting date interval to 14 days.
$expire = (Get-Date).AddDays(-14)
# Outfile and append date string to name.
$ITout = "C:\ExiredITUsers_$today.txt"
$Userout = "C:\ExpiredEndUsers_$today.txt"
$ITsearch = "OU=Users,OU=IT,OU=xxx,OU=xxx,DC=xxx,DC=xxx,DC=xx,DC=xx"
$usersearch = "OU=Users,OU=xxx,OU=xxx,DC=xxx,DC=xxx,DC=xx,DC=xx"
# Get IT expired users and move to the disabled OU.
$ExpiredIT = Get-ADUser -SearchBase $itsearch -Filter * -Properties AccountExpirationDate, Name, DisplayName | where {$_.AccountExpirationDate -le $expire} | where{$_.AccountExpirationDate -ne $null} | select Name, DisplayName, AccountExpirationDate | sort
AccountExpirationDate | fl Name, DisplayName, AccountExpirationDate
$ExpiredIT | Out-File -FilePath $ITout
$ITtotal = $ExpiredIT.Count
if ($ExpiredIT -eq $null){
$body = "No IT accounts have been expired within the last 14 days.`n`nOutput file for IT users is: `n$ITout"
}
else{
$body = "The following IT accounts have expired. They have been disabled and moved to the IT disabled users OU.`nTotal accounts expired is: $ITtotal `n`nOutput file for IT users is: `n$ITout"
#$out = $ExpiredIT #| Out-String
#$body += $out
}
$body += "`n`nAdditionally...`n`n"
# Get expired end users and move to the disabled OU.
$ExpiredUser = Get-ADUser -SearchBase $usersearch -Filter * -Properties AccountExpirationDate, Name, DisplayName | where {$_.AccountExpirationDate -le $expire} | where{$_.AccountExpirationDate -ne $null} | select Name, DisplayName, AccountExpirationDate | sort
AccountExpirationDate | fl Name, DisplayName, AccountExpirationDate
$ExpiredUser | Out-File -FilePath $Userout
$totals = $ExpiredUser.Count
if ($ExpiredUser -eq $null){
$body += "No end user accounts have been expired within the last 14 days. `n`nScript location is xxx.ps1 `nOutput file for end users: `n$Userout"
}
else{
$body += "The following end user accounts have expired. They have been disabled and moved to the disabled users OU.`nTotal accounts expired is: $totals `n `nOutput file is: `n$Userout `n`nScript location is: `nServer: MailServer`nC:\xxx.ps1"
#$out = $ExpiredUser #| Out-String
#$body += $out
}
Send-MailMessage -To "xxx@xxx" -From "xxx@xxx" -Subject "Expired Accounts" -SmtpServer "xxx" -Body $body -Attachments $ITout, $Userout
# Disable and move expired IT staff.
$ExpiredITS = Get-ADUser -SearchBase $ITsearch -Filter * -Properties AccountExpirationDate, Name, DisplayName | where {$_.AccountExpirationDate -le $expire} | where{$_.AccountExpirationDate -ne $null} | select Name
foreach ($account in $ExpiredITS){
$account = $account.Name
Disable-ADAccount -Identity $account
Get-ADUser $account | Move-ADObject -TargetPath "OU=Users,OU=IT,OU=xxx,OU=xxx,DC=xxx,DC=xxx,DC=xx,DC=xx"
}
# Disable and move expired end user staff.
$ExpiredUsers = Get-ADUser -SearchBase $usersearch -Filter * -Properties AccountExpirationDate, Name, DisplayName | where {$_.AccountExpirationDate -le $expire} | where{$_.AccountExpirationDate -ne $null} | select Name
foreach ($account in $ExpiredUsers){
$account = $account.Name
Disable-ADAccount -Identity $account
Get-ADUser $account | Move-ADObject -TargetPath "OU=Users,OU=xxx,OU=xxx,DC=xxx,DC=xxx,DC=xx,DC=xx"
}