Disable user - Until they log in again

[googlemad]

Is there any way to disable a load of user accounts but automatically have them enable again once the user enters their correct username and password?

 

We're 'not allowed' to simply wipe all the student accounts and start fresh any more due to how our courses no longer seem to stick to simple academic years (Apprentices etc confuse matters!) so I was thinking disable the lot of them and the ones which haven't logged back in after a set date in late September / October can be deleted.

[jonawd]

Not that I know... If your looking to find users who haven't used their accounts though, can you use the 'lastLogon' and 'lastLogonTimeStamp' attributes in AD to work that out?

[Roberto]

What precise functionality will you get from "Disabling them until they log back in again" that isn't granted by just, y'know, leaving them?

[FN-GM]

What precise functionality will you get from "Disabling them until they log back in again" that isn't granted by just, y'know, leaving them?

 

I am confused as well. Also what is gained from Deleting all the students accounts?

[plexer]

The ones that were reactivated in Sept by them logging in would then be an easy indicator of the active accounts.

 

But no you can't you'll have to deactivate them all and reactivate the ones that come and ask.

 

Ben

[JSchlackman]

Just leave them on and query by last logon time come September. This PowerShell script should find all the accounts that haven't logged in in 30 days and disable them:

 

$daysInactive = 30  
$time = (Get-Date).Adddays(-($daysInactive))

Get-ADUser -Filter {LastLogonTimeStamp -lt $time} -SearchBase "OU=Students,DC=yourdomain,OU=internal" | Disable-ADAccount

 

Note that this uses the lastLogonTimeStamp attribute, which has 2 caveats: it only gets populated on 2003 level domains and higher, and it is only guaranteed to be accurate if the user's last logon was 14 days or more in the past.