学习的阶段

任何技能从不知道到精通都要经历以下几个阶段：

从不知道到知道：需要你看书了解概念、上课、记笔记、实践

从知道到笨拙：需要你粗糙的尝试去做、不需要过多的准备、先做起来、在犯错的过程进行不断的优化、改进

从笨拙到熟练：需要你专注刻意的练习、逐渐摸索最简化的方法论

从熟练到精通: 需要你短时间进行大量密集刻意的练习、找到本质和规律；化繁为简并形成条件反射、利用潜意识帮你做好

Use -notlike “*” for empty/no mailboxes

Get-ADUser -Filter ‘ProxyAddresses -like “*” -and lastLogonDate -lt $date’ -Properties $properties -ResultSetSize 2000 |

ForEach-Object {

    [PSCustomObject]@{ 

        Path        = $_.CanonicalName

        'AD Status' = ('Disabled', 'Enabled')[[Int32]$_.Enabled]

        LastLogonDate = $_.LastLogonDate

        WhenCreated   = $_.WhenCreated

        RecipientType = $(if ($_.msExchRecipientTypeDetails) {$recipientType[$_.msExchRecipientTypeDetails]})

        userPrincipalName = $_.userPrincipalName

        SamAccountName = $_.SamAccountName

        mailNickname = $_.mailNickname

        Primaryemail = $_.ProxyAddresses -cmatch '^SMTP:' -replace '^smtp:'

        ProxyAddresses = $_.ProxyAddresses

        displayName = $_.displayName

        givenName = $_.givenName

        sn = $_.sn

        title = $_.title

        department = $_.department

        physicalDeliveryOfficeName = $_.physicalDeliveryOfficeName

        telephoneNumber = $_.telephoneNumber

        mobile = $_.mobile

        streetAddress = $_.streetAddress

        l = $_.l

        st = $_.st

        postalCode = $_.postalCode

        c = $_.c

    }

} |

Export-Csv $home\desktop\Inactivembxreport.csv -NoTypeInformation -Encoding Utf8

Windows ActiveDirectory 移除用户所属的组

$UserToRemove = “lijianhang@thtfpc.com”

Try {
#Connect to Exchange Online
# Connect-ExchangeOnline

#Get All Distribution Lists - Excluding Mail enabled security groups
$Groups = Get-ADGroup -Filter *  |  Where {($_.GroupCategory -contains "Distribution" -or $_.GroupCategory  -contains "Security")}  | Select-Object -Property  SamAccountName
#$Groups = Get-Distributiongroup -resultsize unlimited |  Where {( $_.GroupType  -contains "Security")}

#Loop through each Distribution Lists
ForEach ($Group in $Groups)
{
    #Check if the Distribution List contains the particular user
    If ((Get-DistributionGroupMember $Group.Name | Select -Expand PrimarySmtpAddress) -contains $UserToRemove)
    {
        Remove-DistributionGroupMember -Identity $Group.Name -Member $UserToRemove -Confirm:$false
        Write-host "Removed user from group '$Group'" -f Green
    }
}

}
Catch {
write-host -f Red “Error:” $_.Exception.Message
}

将用户移除所属AD组

$ouPath = “DC=thtfpc,DC=com”
$users = Get-ADUser -SearchBase $ouPath -Filter {Enabled -eq $false}
foreach ($user in $users) {
$userDN = $user.DistinguishedName
$groups = Get-ADPrincipalGroupMembership -Identity $userDN | Where-Object { $_.Name -ne “Domain Users” }
foreach ($group in $groups) {
Remove-ADGroupMember -Identity $group -Members $user -Confirm:$false
}
}

Windows ActiveDirectory 批量迁移用户

从 CSV 文件禁用用户

您还可以禁用逗号（.csv）文本文件中列出的所有 Active Directory 用户帐户。该文件必须包含一个标头，然后包含一个用户名列表，每行一个。我的CSV文件只有一列（标题为“名称”），所以我的逗号分隔文件没有逗号！如果 CSV 文件包含多个列，则脚本将忽略这些额外的列。

如：

首先将 CSV 文件的内容作为对象（$users）导入，然后使用ForEach循环禁用文本文件每一行上的用户。下面是 PowerShell 脚本：

180天非活动用户，这里-TimeSpan可以手动指定日期

$timespan = New-Timespan -Days 180
Search-ADAccount -UsersOnly -AccountInactive -TimeSpan $timespan | Select-Object UserPrincipalName ,Name | Export-Csv -Path C:\InactiveUser.csv -Encoding UTF8 -NoTypeInformation

$users=Import-CSV c:\InactiveUser.csv

ForEach ($User01 in $users) { Disable-ADAccount -Identity $($user.name)

Get-ADUser -Identity $User01.Name | foreach {Move-ADObject -Identity $_.ObjectGuid -TargetPath ‘OU=DisableUsers,OU=2024年,OU=离职员工,DC=abc,DC=com’ }

}

若要检查结果，请使用搜索 ADAccountcmdlet：Search-ADAccount -AccountDisabled -UsersOnly | Select-Object Name, SamAccountName

值得注意的是，由于 Active Directory 同步LastLogOnDate属性的方式，在使用Search-ADAccountcmdlet 指定 –AccountInactive参数时返回的结果可能不准确多达 9-14 天

作者： xiahan

社会上的人情世故

学习的阶段

Exchange 统计用户登录情况

Use -notlike “*” for empty/no mailboxes

Windows ActiveDirectory 移除用户所属的组

Windows ActiveDirectory 批量迁移用户

从 CSV 文件禁用用户