$Date = (Get-Date).ToString("dd-MM-yyyy"), $NamedExceptions = (Get-Content $ScriptPath`ADnamedExceptions.txt), $Server = "DC002.domain.com" ) Function Get-AgedAccounts { Param ( [string]$AccountType, [int]$AgedAccountThreshold, [int]$NewAccountThreshold ) $LastLogonDate = (Get-Date).AddDays(-$AgedAccountThreshold) $WhenCreated = (Get-Date).AddDays(-$NewAccountThreshold) If ($AccountType -eq "User") { $AgedAccounts = Get-ADUser -Filter { (enabled -eq $True -and PasswordNeverExpires -eq $False -and WhenCreated -lt $WhenCreated -and samAccountType -eq "805306368") -and ((LastLogonDate -lt $LastLogonDate) -or (LastLogonDate -notlike "*")) } -Properties lastLogonDate,whenCreated,passWordLastSet,whenChanged -Server $server | Select-Object -Properties distinguishedName,samAccountName,lastLogonDate,whenCreated,passWordLastSet,whenChanged,objectClass $AgedAccounts } ElseIf ($AccountType -eq "Computer") { $AgedAccounts = Get-ADComputer -Filter { (enabled -eq $True -and PasswordNeverExpires -eq $False -and WhenCreated -lt $WhenCreated -and samAccountType -eq "805306369") -and ((LastLogonDate -lt $LastLogonDate) -or (LastLogonDate -notlike "*")) } -Properties lastLogonDate,whenCreated,passWordLastSet,whenChanged -Server $server | Select-Object -Property distinguishedName,samAccountName,lastLogonDate,whenCreated,passWordLastSet,whenChanged,objectClass $AgedAccounts } Else { $AgedAccounts } } Function Get-DisabledAccounts { Param ( [string]$AccountType, [int]$LastModifiedThreshold ) $LastModifiedDate = (Get-Date).AddDays(-$LastModifiedThreshold) If ($AccountType -eq "User") { $DisabledAccounts = Get-ADUser -Filter { enabled -eq $False -and samAccountType -eq "805306368" -and whenChanged -lt $LastModifiedDate } -properties lastLogonDate,whenCreated,passWordLastSet,whenChanged -server $server | Select-Object -Property distinguishedName,samAccountName,lastLogonDate,whenCreated,passWordLastSet,whenChanged,objectClass $DisabledAccounts } ElseIf ($AccountType -eq "Computer") { $DisabledAccounts = Get-ADComputer -Filter { enabled -eq $False -and samAccountType -eq "805306369" -and whenChanged -lt $LastModifiedDate } -properties lastLogonDate,whenCreated,passWordLastSet,whenChanged -server $server | Select-Object -Property distinguishedName,samAccountName,lastLogonDate,whenCreated,passWordLastSet,whenChanged,objectClass $DisabledAccounts } Else { $DisabledAccounts } } $AgedAccounts = $null $AgedAccounts = Get-AgedAccounts User 45 21 $AgedAccounts += Get-AgedAccounts Computer 45 14 $AgedAccounts.Count $DisabledAccounts = $null $DisabledAccounts = Get-DisabledAccounts Computer 183 # $DisabledAccounts += Get-DisabledAccounts User 183 $DisabledAccounts.Count ForEach ($AgedAccount in $AgedAccounts) { If ($NamedExceptions -contains $AgedAccount.DistinguishedName) { $Result = "Match found in named exceptions file" } Else { Disable-ADAccount $AgedAccount.DistinguishedName -Server $Server # -WhatIf $Result = $? } Add-Member -InputObject $AgedAccount -MemberType NoteProperty ` -Name ScriptDisabled -Value $Result } $LogFile = $Date + "disabled accounts.csv" $AgedAccounts | Export-Csv $ScriptPath$LogDirectory$LogFile -NoTypeInformation ForEach ($DisabledAccount in $DisabledAccounts) { If ($NamedExceptions -contains $DisabledAccount.DistinguishedName) { $Result = "Match found in named exceptions file" } Else { Remove-ADObject $DisabledAccount.DistinguishedName -Server $Server -Confirm:$False -Recursive # -WhatIf $Result = $? } Add-Member -InputObject $DisabledAccount -MemberType NoteProperty -Name ScriptDeleted -Value $Result } $LogFile = $Date + "-deleted accounts.csv" $DisabledAccounts | Export-Csv $ScriptPath$LogDirectory$LogFile -NoTypeInformation