title: Powershell Script to Disable Inactive AD Users Create Log and Send E-mail
body: <p>A colleague has reached out to me to create a PowerShell script to do the following:</p>
  
  <p>The script would read the lastlogondate of an AD security group called “Temp Associates”, disable the accounts with lastlogondate > or = 29 days from current date and move to Disabled OU.  When it disables it will also change the descripton to the date it was disabled on.  Then create a report listing disabled users and email to our global helpdesk.</p>
  
  <p>I've compiled some things together that seem like they should work, but do not.  When I run the script I receive no error message and the log file is generated with no data populated.  In order to remain SOX compliant I should be able to manipultate the value in <code>$PasswordAge = (Get-Date).adddays(-29)</code> for testing purposes as I'm not sure we have any accounts that meet the requirements currently.</p>
  
  <p>E-mail is working now, just had to create PSCredential to use in send-mailmessage -credential parameter.</p>
  
  <p>I am definitley new to PowerShell and can use all the help I can get.  Any suggestions to either improve the existing code or use a different method are welcome, but I'd like to utilize what I already have if possible.</p>
  
  <p>Code Below:</p>
  
  <pre><code>#import the ActiveDirectory Module
  Import-Module ActiveDirectory
  
  #Create a variable for the date stamp in the log file
  $LogDate = get-date -f yyyyMMddhhmm
  
  #Sets the OU to do the base search for all user accounts, change for your env.
  $SearchBase = "CN=Temp Associates,OU=Res Accounts,DC=our,DC=domain,DC=org"
  
  #Create an empty array for the log file
  $LogArray = @()
  
  #Sets the number of days to disable user accounts based on lastlogontimestamp and pwdlastset.
  $PasswordAge = (Get-Date).adddays(-29)
  
  #Use ForEach to loop through all users with pwdlastset and lastlogontimestamp greater than date set. Also added users with no lastlogon date set. Disables the accounts and adds to log array.
  #Add the properties you will be using to ensure they are available.
  $DisabledUsers = (Get-ADUser -searchbase $SearchBase -Properties samaccountname, name, distinguishedname -filter {((lastlogondate -notlike "*") -OR (lastlogondate -le $Passwordage)) -AND (enabled -eq $True) -AND (whencreated -le $Passwordage)} )
  
  if ($DisabledUsers -ne $null -and $DisabledUsers.Count &gt; 0) {
      ForEach ($DisabledUser in $DisabledUsers) {
  
          #Sets the user objects description attribute to a date stamp. Example "11/13/2011"
          set-aduser $DisabledUser -Description ((get-date).toshortdatestring()) -whatif
  
          #Disabled user object. To log only add "-whatif"
          Disable-ADAccount $DisabledUser -whatif
  
          #Create new object for logging
          $obj = New-Object PSObject
          $obj | Add-Member -MemberType NoteProperty -Name "Name" -Value $DisabledUser.name
          $obj | Add-Member -MemberType NoteProperty -Name "samAccountName" -Value $DisabledUser.samaccountname
          $obj | Add-Member -MemberType NoteProperty -Name "DistinguishedName" -Value $DisabledUser.DistinguishedName
          $obj | Add-Member -MemberType NoteProperty -Name "Status" -Value 'Disabled'
  
          #Adds object to the log array
          $LogArray += $obj
  
      }
  
      # Move disabled users in Temp Associates group to Disabled OU 
      Search-ADAccount –AccountDisabled –UsersOnly –SearchBase “CN=Temp Associates,OU=Res Accounts,DC=our,DC=domain,DC=org”  | 
      Move-ADObject –TargetPath “OU=Disabled,DC=our,DC=domain,DC=org” -WhatIf
  
      #Exports log array to CSV file in the temp directory with a date and time stamp in the file name.
      $logArray | Export-Csv "C:\Temp\User_Report_$logDate.csv" -NoTypeInformation
  
      #Create PSCredential for use in e-mail -credential parameter
      $secpasswd = ConvertTo-SecureString "PasswordHere" -AsPlainText -Force
      $mycreds = New-Object System.Management.Automation.PSCredential ("UserHere", $secpasswd)
  
      #Send e-mail to Global Helpdesk with report generated
      $emailFrom = "smtp@address.com"
      $emailTo = "User@address.com" 
      $subject = "NA Disabled Temp Users to be deleted" 
      $smtpServer = "smtp.address.com"
      $attachment = "C:\Temp\User_Report_$logDate.csv"
  
  
      Send-MailMessage -To $emailTo -From $emailFrom -Subject $subject -SmtpServer $smtpServer -attachment $attachment -credential $mycreds
  }else {
      Write-Output "No disabled users to process for $PasswordAge."
  
      #Create PSCredential for use in e-mail -credential parameter
      $secpasswd = ConvertTo-SecureString "PasswordHere" -AsPlainText -Force
      $mycreds = New-Object System.Management.Automation.PSCredential ("UserHere", $secpasswd)
  
      #Send e-mail to Global Helpdesk with report generated
      $emailFrom = "smtp@address.com"
      $emailTo = "User@address.com" 
      $subject = "NA Disabled Temp Users to be deleted" 
      $smtpServer = "smtp.address.com"
      $attachment = "C:\Temp\User_Report_$logDate.csv"
      Send-MailMessage -To $emailTo -From $emailFrom -Subject $subject -Body "No disabled users to process for $PasswordAge." -SmtpServer $smtpServer -credential $mycreds
  }
  </code></pre>