How to Disable Active Directory Account Using PowerShell

5.6K

The Disable-ADAccount PowerShell cmdlet is used to disable user, computer, and service accounts in an Active Directory domain. Disabled accounts cannot be used to log on to the domain, even if the user knows the account’s password and it is has not expired.

Disabling Active Directory Users with PowerShell

To disable a user account in a domain, use the Disable-ADAccount cmdlet from the PowerShell Active Directory module. Just specify the SamAccountName, DistinguishedName, SID, or ObjectGUID of the user that you want to disable as an attribute of the cmdlet:

Disable-ADAccount jbrion

Enterprise tip. In multi-domain or multi-site AD environments, you can use the -Server parameter to target a specific DC when enabling or disabling accounts:

Disable-ADAccount -Identity jbrion -Server dc01.contoso.com

Check if the account is disabled now.

Get-ADUser jbrion |select name,enabled

The cmdlet should return: Enabled = False.

Tip. In order to check bulk operations, you can use:

Search-ADAccount -AccountDisabled -UsersOnly |
Select-Object Name, SamAccountName

If an AD-disabled user tries to log on to any computer in the domain, he will get an error:

Your account has been disabled. Please see your system administrator.

In order to enable user account in Active Directory use the command:

Enable-ADAccount jbrion

Note that changes may take time to replicate to other DCs depending on your AD replication topology.

Disabling an on-premises AD account is synced to Microsoft Entra ID when using Microsoft Entra Connect, according to your sync config.

How to Disable Computer Accounts in AD with PowerShell

The Disable-ADAccount cmdlet can also be used to disable computer (machines) accounts in AD. When specifying a domain computer name, add a dollar sign ($) to the end of the hostname. For example:

Disable-ADAccount -Identity la-wks21$

To enable a machine account in AD:

Enable-ADAccount -Identity la-wks21$

Automatically Disable AD Accounts at a Specific Time

The accountExpires attribute can be used to automatically disable AD user accounts after a certain date. In a user’s Active Directory properties the accountExpires attribute specifies the date after which their account will expire (not set by default).

The account expiration date can be set in the ADUC graphical console on the Account tab. In the Account expires section, enable the End of option and specify the date after which the system will automatically deactivate the user account.

Or set the account expiration time using the Set-ADAccountExpiration cmdlet.

For example, to disable an account after a specific date:

$expireDate = Get-Date "2025-08-15"

Set-ADAccountExpiration -Identity b.jackson -DateTime $expireDate

Disable user account after 90 days:

$expireDate = New-TimeSpan -Days 90

Set-ADAccountExpiration -Identity b.jackson -TimeSpan $expireDate

Check the expiration date for an account:

Get-ADUser b.jackson -Properties AccountExpirationDate

Even if an Active Directory user’s accountExpires attribute is set to an expiration date that has passed, the system will not automatically disable the account solely due to the expiration. However, the user will be unable to log in because the system considers the account expired.

Use this one-line PowerShell command to find and disable all expired user accounts in Active Directory:

Search-ADAccount -AccountExpired -UsersOnly | Disable-ADAccount -Verbose

Disabling Multiple Active Directory Accounts with PowerShell

You can use PowerShell to disable/enable multiple AD objects in bulk. Let’s look at some real-world scenarios commonly used for bulk account disabling in AD:

Enterprise tip. Before running bulk operations through the PowerShell pipeline, you should consider using the -WhatIf or -Confirm parameters in order to verify/confirm the changes before they are applied.

You can preview the affected accounts with the command:

Get-ADUser -Filter * -SearchBase "OU=Laptops,OU=NY,OU=USA,DC=theitbros,DC=com" |
Disable-ADAccount -WhatIf

Require confirmation for each operation:

Get-ADUser -Filter * -SearchBase "OU=Laptops,OU=NY,OU=USA,DC=theitbros,DC=com" |
Disable-ADAccount -Confirm

Disable all user accounts in a specific Organizational Unit (OU):

Get-ADUser -Filter * -SearchBase "OU=Laptops,OU=NY,OU=USA,DC=theitbros,DC=com" | Disable-ADAccount

Disable all users from a specific department:

Get-ADUser -Filter {Department -eq "Sales"}| Disable-ADAccount

Disable users who are members of a specific security group:

Get-ADGroupMember -Identity "ExternalITStuff" -Recursive |
Where-Object { $_.objectClass -eq "user" } |
Disable-ADAccount

Find and disable inactive users who haven’t logged on to the domain for more than 6 months:

$timespan = New-Timespan -Days 180

Search-ADAccount -UsersOnly -AccountInactive -TimeSpan $timespan | Disable-ADAccount

Enterprise tip. Search-ADAccount searches the entire domain by default. In large AD environments, you should consider limiting the scope of bulk operations by querying a specific OU with Get-ADUser -SearchBase before piping the results to Disable-ADAccount.

Get-ADUser -Filter * `
-SearchBase "OU=Sales,DC=theitbros,DC=com" |
Disable-ADAccount

Disable inactive computer accounts:

Search-ADAccount -ComputersOnly -AccountInactive -TimeSpan $timespan | Disable-ADAccount

Disable users according to a list from a CSV file:

Create a simple CSV file ADUserList.csv with the following flat structure:

"Username","Date","Enabled"
"b.jackson","2021-12-24","False"
"jsmith","2022-10-11","False"
"m.brion","2021-03-12","False"

The usernames and dates when their accounts need to be disabled should be set in this file. Use the following PowerShell script to disable multiple users from a CSV file:

Import-module ActiveDirectory

$users=Import-csv -Path "c:\ps\ADUserList.csv"
foreach ($user in $users) {
if ((Get-Date) -ge ([datetime]$user.Date)) {
if ($user.enabled -eq "False"){Disable-ADAccount -Identity $user.Username}
}
}

List all disabled machine accounts in the domain:

Search-ADAccount -AccountDisabled -ComputersOnly|select Name,LastLogonDate,Enabled

List the disabled AD user accounts:

Search-ADAccount -AccountDisabled -UsersOnly

You can also disable multiple accounts at once using the ADUC snap-in. Expand the Active Directory OU where the account is located. Select multiple accounts by holding down the CTRL key, right-click and select Disable Account.

If you want to disable multiple accounts from the ADUC graphical console, but they are in different OUs, you can inflate your Active Directory structure using AD Saved Query.

Select the Saved Queries section in the ADUC console and create a new Query.

Select Define Query > Find > Custom Search. Use the following LDAP query to find users with a specific value in the Company attribute.

(&(objectcategory=person)(objectclass=user)(!userAccountControl:1.2.840.113556.1.4.803:=2)(company=theitbros))

Click the OK button to save the query. Then find and select your query in Saved Queries. Press the F5 key to refresh the search results. As a result, a list of accounts that match your requests will appear in the window.

Select user accounts (CTRL + A or use CTRL/Shift keys) and click Disable Account.

Before disabling privileged/service accounts, you should verify that they are not required by apps, scheduled tasks, or critical infrastructure.

Delegate the Disable/Enable Accounts Permissions in AD

You can delegate the administrative permissions to enable/disable accounts in Active Directory for a specific security group of users, such as HelpdeskTeam.

Right-click in the ADUC console on the OU to which you want to delegate permissions. Select Delegate Control.

Specify the name of the group to which you want to delegate permissions (for example, US_HepldeskTeam). Then select Create a custom task to delegate > select User objects > select Property-specific permissions: Write userAccountControl.

Save your changes. Your non-admin user group will now be able to enable or disable a user account in a specific Organizational Unit.

You may need to track which delegated user has enabled or disabled a specific user account in Active Directory. To do this, you must enable the account management audit policy for AD domain controllers (Audit Account Management under Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Audit Policies).

After that, you can search for the following events under the User Account Management task category in the Security log on the DC:

• Event ID 4725 — A user account was disabled.
• Event ID 4722 — A user account was enabled.

These events contain details about the user account that was disabled (or enabled), including the admin who performed the action (Subject), the target user account (Target account), and the time of the event.