How to Delete AD User Using PowerShell?

Are you tired of manually deleting users from the Active Directory Users and Computers (ADUC) interface? Or are you facing the challenge of processing bulk AD user deletion requests? PowerShell can help simplify this process for you. In this tutorial, we will walk through using PowerShell to delete AD users.

Requirements

• Windows Active Directory Domain Controller. This tutorial uses Windows Server 2019, and the domain is theitbros.com.
• An account with sufficient access to delete users in Active Directory.
• Windows PowerShell 5.1 or newer.
• A code editor. In this post we will use Visual Studio Code.
• If you’re using a management computer (not the DC), make sure to install the Remote Server Administration Tool (RSAT).

The Remove-ADUser Cmdlet

The Remove-ADUser cmdlet is an essential cmdlet in PowerShell that allows admins to delete user accounts from Active Directory. This cmdlet requires the Active Directory PowerShell module (installed through RSAT or on a Domain Controller).

The syntax for the Remove-ADUser cmdlet is straightforward. Here is an example:

Remove-ADUser -Identity "jdoe"

This cmdlet takes various parameters, such as -Identity, which specifies the user account to be deleted. The acceptable identity values are:

• A Distinguished name
• A GUID (objectGUID)
• A Security Identifier (objectSid)
• A SAM account name (sAMAccountName)
  

  

You can also use other parameters such as -Confirm and -WhatIf to confirm the deletion or to preview the changes that will be made.

In some parts of this tutorial, we will also be using the Search-ADAccount and Get-ADUser cmdlets. The Search-ADAccount cmdlet is used to search for user accounts that meet certain criteria, such as accounts that have been inactive for a specific period. The Get-ADUser cmdlet is used to retrieve user accounts from Active Directory.

Using these cmdlets in combination with Remove-ADUser can make the process of deleting user accounts from Active Directory much more efficient and straightforward.

Delete a Single AD User

To delete a single AD user, you can use the Remove-ADUser cmdlet followed by the -Identity parameter, which specifies the user account to be deleted. Here’s an example:

Before deleting an account, you need to check if you are removing the correct object and review important attributes (such as DistinguishedName, Enabled status, group memberships, and last logon info).

Get-ADUser -Identity sdavis -Properties Enabled,LastLogonDate,MemberOf |
Select-Object Name,SamAccountName,Enabled,LastLogonDate

# Preview deletion first
Remove-ADUser -Identity sdavis -WhatIf

# Remove -WhatIf only after verification
Remove-ADUser -Identity sdavis

This command will delete the user account with the username “sdavis” from Active Directory. You can use the -WhatIf parameter first to verify that the correct account will be removed before performing the actual deletion.

The default behavior of Remove-ADUser is to prompt for confirmation, as you can see in the previous example. But you can also use the -Confirm:$false parameter to suppress the prompt and force the user account deletion.

Remove-ADUser -Identity sdavis -Confirm:$false

The example below adds the -Verbose switch to turn on verbose feedback.

Get-ADPrincipalGroupMembership sdavis | Select-Object Name,GroupScope,GroupCategory

Disabling Instead of Delete: Recommended Method

In enterprise AD environments, permanently deleting user accounts immediately is usually not recommended. A safer method is to disable the account first, move it to a dedicated Organizational Unit (OU), and keep it for a defined retention period before deletion.

This allows you to:

• restore the account if the deletion was accidental;
• preserve the user object and its attributes for auditing;
• review group memberships and application dependencies;
• meet compliance and retention requirements.

In order to disable a user account, use the Disable-ADAccount cmdlet:

Disable-ADAccount -Identity sdavis

After disabling the account, you need to move it to a dedicated OU (such as OU=Disabled Users):

$user = Get-ADUser -Identity sdavis

Move-ADObject `
-Identity $user.DistinguishedName `
-TargetPath "OU=Disabled Users,DC=theitbros,DC=com"

Now you can check if the account is disabled:

Get-ADUser -Identity sdavis -Properties Enabled |
Select-Object Name,Enabled

Here is an example output:

Name Enabled
---- -------
sdavis False

A common account lifecycle process is:

• Disable the account immediately after the user leaves the organization;
• Move the account to a dedicated disabled users OU;
• Retain the account for a defined period (for example, 30–90 days);
• Review dependencies and delete the account permanently if it is no longer required.

After the retention period expires, you can remove the account using the following command:

Remove-ADUser -Identity sdavis

If you want to delete a user account based on a specific attribute, such as the email address, you can use the Get-ADUser cmdlet to retrieve the user account and then pipe it to the Remove-ADUser cmdlet. Here’s an example:

$user = Get-ADUser -Filter {UserPrincipalName -eq "sdavis@theitbros.com"}

$user | Select Name,SamAccountName,DistinguishedName

$user | Remove-ADUser -WhatIf

This command will retrieve the user account with the UPN “sdavis@theitbros.com” and then delete it from Active Directory.

Restore Deleted AD Users with Active Directory Recycle Bin

Active Directory Recycle Bin must be enabled before deletion (it allows restoring deleted users with most attributes preserved). Use the command:

$user = Get-ADObject `
-Filter {isDeleted -eq $true -and SamAccountName -eq "sdavis"} `
-IncludeDeletedObjects

Restore-ADObject -Identity $user.ObjectGUID

Note that the AD Recycle Bin must be enabled before the object is deleted. It cannot restore objects that were deleted before the feature was enabled.

Delete Multiple Users from an Array

To delete multiple users where the list of users is in an array object, use the following command:

$users = "username1","username2","username3"

foreach ($user in $users) {
    Remove-ADUser -Identity $user -WhatIf
}

Replace username1, username2, and username3 with the usernames of the user accounts that you want to delete.

If there are a bulk of users to delete, it will make more sense to put them on a list and have PowerShell read that list. So as an alternative to writing each username, we can import them from a text file.

For example, let’s assume we have a list of users in a file called UsersToDelete.txt.

This code will read each line from the UsersToDelete.txt file, which should contain a list of usernames, and delete each user account.

$users = Get-Content .\UsersToDelete.txt

foreach ($user in $users) {
    Remove-ADUser -Identity $user -WhatIf
}

Auditing AD User Deletions with SIEM Solutions

In enterprise environments, you should monitor and audit bulk deletion of AD users. Security teams often forward AD audit events to SIEM platforms (such as Microsoft Sentinel or Splunk) in order to track account deletion activities.

On DCs, you can enable Audit User Account Management through the Default Domain Controllers Policy. Navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Account Management > Audit User Account Management.

When a user account is deleted, DCs generate security events such as:

• Event ID 4726 — A user account was deleted
• Event ID 4725 — A user account was disabled
• Event ID 4722 — A user account was enabled

These events contain info about:

• the admin who performed the action;
• the deleted account;
• the computer where the action was performed;
• the timestamp of the operation.

SIEM solutions can collect these events and create alerts for suspicious activity. Here is an example:

• multiple user deletions within a short period;
• deletion of privileged accounts;
• deletion outside of approved maintenance windows.

For example, Microsoft Sentinel can collect AD security events through Azure Monitor Agent/Microsoft Defender for Identity, while Splunk can ingest Windows Security Event Logs using Splunk Universal Forwarder.

Use a CSV File to Bulk User Removal

For bulk user removal in enterprise environments, it is often more convenient to use a CSV file instead of a simple text list. CSV files allow you to store additional info about each account (such as department, reason for deletion, or employee status).

Here is an example of UsersToDelete.csv:

SamAccountName,Department,Reason
sdavis,Sales,Employee left company
jdoe,HR,Contract ended

Now import the CSV file and remove users with the command:

$users = Import-Csv .\UsersToDelete.csv

# Review users before deletion
$users | Select-Object SamAccountName,Department,Reason

# Preview deletion
foreach ($user in $users) {
    Remove-ADUser -Identity $user.SamAccountName -WhatIf
}

# After verification
foreach ($user in $users) {
    Remove-ADUser -Identity $user.SamAccountName -Confirm:$false
}

Delete Disabled AD User Accounts Safely

To delete disabled user accounts in Active Directory using PowerShell, you can use the Get-ADUser and Remove-ADUser cmdlets in conjunction with the -Filter parameter to find and remove the appropriate accounts.

First, you can use the Get-ADUser cmdlet with the -Filter parameter to retrieve a list of disabled users. For example, to retrieve disabled user accounts from a specific OU, you can use the following command:

In enterprise environments, you should avoid searching the entire domain when performing account cleanup. Limit the query scope to a dedicated OU that contains disabled/terminated accounts.

$disabledUsers = Get-ADUser `
-SearchBase "OU=Disabled Users,DC=theitbros,DC=com" `
-Properties isCriticalSystemObject `
-Filter { Enabled -eq $false } |
Where-Object { $_.isCriticalSystemObject -ne $true } 

# Review users before deletion
$disabledUsers | Select-Object Name,SamAccountName,DistinguishedName

# Export the list for backup and review
$disabledUsers |
Select Name,SamAccountName,DistinguishedName,LastLogonDate |
Export-Csv .\disabled-users.csv -NoTypeInformation

# Preview deletion
$disabledUsers | Remove-ADUser -WhatIf

# After verification, delete users
$disabledUsers | Remove-ADUser -Confirm:$false -Verbose

This code retrieves disabled AD user accounts that are not marked as critical system objects and then removes them from Active Directory.

Here is how it works:

• $disabledUsers = Get-ADUser -Properties isCriticalSystemObject -Filter { Enabled -eq $false }: This line uses the Get-ADUser cmdlet to retrieve a list of disabled user accounts. The Properties parameter is used to include the isCriticalSystemObject attribute, which is used later to filter out any critical system objects. The Filter parameter is used to retrieve only disabled users.
• | Where-Object { $_.isCriticalSystemObject -ne $true }: This line uses the Where-Object cmdlet to filter out any critical system objects from the list of disabled users. The $_ variable represents the current object in the pipeline, which is a user account. The ne operator is used to exclude any user accounts where the isCriticalSystemObject attribute is $true.
• $disabledUsers | Remove-ADUser -Confirm:$false -Verbose: This line pipes the list of disabled user accounts to the Remove-ADUser cmdlet to delete them from Active Directory. The Confirm parameter is set to $false to disable confirmation prompts, and the Verbose parameter is used to display detailed output during the deletion process.

Overall, this code can be useful for removing disabled user accounts from Active Directory while excluding any critical system objects that should not be deleted.

Alternatively, you can use Search-ADAccount to find disabled users. However, always review and filter the results before deletion:

$disabledUsers = Search-ADAccount `
-AccountDisabled `
-UsersOnly |
Where-Object {
    $_.DistinguishedName -match "OU=Disabled Users"
}

# Review accounts before deletion
$disabledUsers | Select-Object Name,SamAccountName,DistinguishedName

# Preview deletion
$disabledUsers | Remove-ADUser -WhatIf

# After verification, remove accounts
$disabledUsers | Remove-ADUser -Confirm:$false

This command will find all disabled user accounts using the Search-ADAccount cmdlet and filter the results to only include user objects. Then, it will pipe the list of disabled user accounts to the Remove-ADUser cmdlet to remove them from Active Directory.

Delete Stale AD User Accounts

The LastLogonTimestamp attribute can be used to identify inactive AD accounts. Because this attribute is replicated between domain controllers and updated periodically, it should be treated as an approximate indicator of inactivity rather than an exact last logon record.

In this section, we will show examples of how to get stale AD users and then delete them.

To get stale AD users or AD users who haven’t logged on to the domain in 90 days, use the following code:

You should avoid running cleanup operations against the entire AD domain unless this is specifically required. It is safer to limit the search scope to dedicated organizational units (OUs), such as disabled users/terminated employee accounts.

The following example searches only the Disabled Users OU:

$staleDate = (Get-Date).AddDays(-90).ToFileTime()

$staleUsers = Get-ADUser `
-SearchBase "OU=Disabled Users,DC=theitbros,DC=com" `
-Properties LastLogonTimestamp,isCriticalSystemObject `
-Filter { LastLogonTimestamp -lt $staleDate } |
Where-Object { $_.isCriticalSystemObject -ne $true }

# Review accounts before deletion
$staleUsers | Select-Object Name,SamAccountName,DistinguishedName,
@{Name="LastLogonDate";Expression={[DateTime]::FromFileTime($_.LastLogonTimestamp)}}

# Export the list for review
$staleUsers |
Select Name,SamAccountName,DistinguishedName,LastLogonTimestamp |
Export-Csv .\stale-users-review.csv -NoTypeInformation

# Preview deletion
$staleUsers | Remove-ADUser -WhatIf

# After verification, delete users
$staleUsers | Remove-ADUser -Confirm:$false -Verbose

Before deleting stale AD accounts, you should always review the list of users and export the results. This allows you to verify that these accounts are not required for admin, apps, services, or compliance retention. We recommend to use the -WhatIf parameter first to preview the accounts that will be deleted.

The -SearchBase parameter limits the search scope and helps prevent accidental deletion of active user accounts located in other OUs.

Note. The LastLogonTimestamp attribute is replicated between DCs and updated periodically, not after every logon. For most stale account cleanup cases this accuracy is sufficient, but you should not use it for precise last logon auditing.

This code finds disabled or terminated user accounts inside the specified OU that have not logged on for 90 days or more. The -SearchBase parameter limits the search scope in order to prevent accidental processing of active user accounts located in other OUs. Here’s how it works:

• The first line of code creates a variable called $staleDate and converts the date that is 90 days in the past into a Windows FileTime value. This format is required because AD stores the lastLogonTimestamp attribute as a 64-bit integer.
• The Get-ADUser cmdlet retrieves user accounts where the LastLogonTimestamp attribute is older than the specified date. The LastLogonTimestamp attribute is stored in AD as a Windows FileTime value, so the comparison uses the .ToFileTime() method.
• The third line of code pipes the $staleUsers variable to the Where-Object cmdlet, which filters out any objects that have the isCriticalSystemObject property set to $true. This is because you generally don’t want to delete critical system accounts.
• Finally, the filtered list of $staleUsers is piped to the Remove-ADUser cmdlet with the Confirm:$false and Verbose parameters. This will delete all of the stale AD users without prompting for confirmation and will provide a verbose output of the deletion process.

You may also improve this code to limit the search scope to specific Active Directory OUs only. For example, you can organize the account lifecycle process using dedicated OUs:

• OU=Disabled Users
• OU=Terminated Employees
• OU=Staging

This approach helps you safely review and remove inactive accounts without affecting active users.

It is important to note that deleting user accounts can have serious consequences, especially if they belong to active users. Before deleting user accounts, it is essential to ensure that they are not needed anymore. You may also want to consider disabling the accounts first and then deleting them after a specified period to ensure that you can restore them if necessary.

Wrapping up

PowerShell provides you with a flexible way to automate AD account lifecycle management. By combining Remove-ADUser with preview steps, OU filtering, retention policies, and audit monitoring, you can safely manage user deletion workflows in enterprise environments.

Remove-ADUser -Identity "JohnDoe"