Monday, July 4, 2016

Ensure all accounts in the Disabled Accounts OU are Disabled

I noticed the help desk was enabling accounts and leaving them in the disabled accounts OU.  We have user based policies that get applied based on your departmental OU.  By not moving the account to the correct departmental OU these policies don’t get applied.  Causes user issues like drive mappings and printer mappings don’t get applied.  After talking with the manager of the help desk who discussed it with their team nothing changed.  This laziness caused un-necessary calls to the help desk where the help desk technician manually mapped drives and printers.  This extra work circumvented our standard process and needed to be fixed so I wrote this.

This script runs multiple times a day and disables every account in the disabled accounts OU.  Once I put this in place and communicated this was happening and should be zero impact to our customers as long as the help desk preformed their job correctly my standards were now being followed.

Start of script

###############################################################################
#  Script Name:   Disable_User_Accounts_in_Disabled_Accounts_OU.ps1
#  Created On:    02/26/2014
#  Author:        Joshua
#  Purpose:       Ensure all accounts in the Disabled Accounts OU are Disabled                                               
#  Last Modified: 04/28/2016
#  Last Modifier: Joshua
###############################################################################

Get-ADUser -Filter 'name -like "*"' -SearchBase "OU=Disabled Accounts,DC=YourDomain,DC=com" | Disable-ADAccount


End of script

No comments:

Post a Comment