CODEWITHSUNDEEP
powershellactive-directory
Cristian
Cristian

Reputation: 15

Disable ADuser if the user still has the check change password at next logon

I'm doing user audits, and I'm assigning the check change password at next logon. After xxx time I run script to remove the check and disable the accounts that still have the check and export these users. I'm trying this way and it's not working for me.

    Get-ADuser -LDAPfilter "(pwdLastSet=0)" | select SamAccountName |

Out-File -FilePath .\users.txt -Append

$users = get-content .\users.txt
foreach ($Row in $users) {
    if(Get-ADUser -LDAPfilter "(sAMAccountName=$($Row.username))"){
        Set-ADUser -ChangePasswordAtLogon $false -Identity $Row.username
        Set-ADUser -Enabled $false -Identity $Row.username -Description "User Disabled after xxxxx days"
    }
}

Someone knows a way to do that and can help me. Thank you.

Upvotes: 0

Views: 215

Answers (1)

ArcSet
ArcSet

Reputation: 6860

The issue is at $Row.username.

$Row is not a hash table and has no properties. Therefore $Row.Username would equal nothing.

Get-ADuser -LDAPfilter "(pwdLastSet=0)" | select SamAccountName | Out-File -FilePath .\users.txt -Force

get-content .\users.txt | %{
    Set-ADUser -Identity $_ -ChangePasswordAtLogon $false -Enabled $false -Description "User Disabled after xxxxx days"
}

Upvotes: 1

Related Questions