禁用ActiveDirectory用戶從特定日期排除列表

Question

我寫了一個腳本，要禁用舊用戶... ，我需要做一個排除列表... 排除列表應爲.csv，3列「名稱」，「SamaccountName」，「原因」... 我是一種卡住與排除列表篩選... 我試圖做-notmatch和-notcontains和沒有爲我工作... 我甚至嘗試如果但同樣做一個foreach ...

Function Get-ADLockOldUsers { 
param() 
begin{ 
    [datetime]$myDate = '01/01/1601 02:00:00' 
    $colObj = @() 
    $AllUsers = (Get-ADUser -Filter * -Properties lastLogonTimestamp | ? {$_.Enabled} | Select-Object Name,SamAccountName,@{N="LastLogon";E={[datetime]::FromFileTime($_.lastLogonTimestamp)}}) 
    $AllUsers = $AllUsers | ? {(Get-Date).AddDays(-30) -gt $_.LastLogon -and -not ($_.LastLogon -eq $myDate)} 
} 
process { 
$AllUsers | % { 
     $obj = New-Object psobject 
     $obj | Add-Member noteproperty 'Name' $_.Name -Force 
     $obj | Add-Member noteproperty 'SamAccountName' $_.SamAccountName -Force 
     $obj | Add-Member noteproperty 'LastLogon' $_.LastLogon -Force 
     $obj | Add-Member noteproperty 'NeedDisabled' $true -Force 
     $colObj += $obj 
     } 
} 
end { return $colObj } 
} 

Function Set-ADLockUser { 
param() 
begin{ 
    if (Test-Path '.\excludeusers.csv') { 
     $excludeUsers = Import-Csv '.\excludeusers.csv' 
     $DUser = @() 
     $colUsers = Get-ADLockOldUsers 
     $colUsers | ? {$_.SamAccountName -notcontains $excludeUsers} | % {Set-ADUser -Identity $_.SamAccountName -Enabled $false -WhatIf } 
     } 
    else { Write-Output "Error! excludeusers.csv cannot be found, stop script"; break } 
    } 
process { 
    } 
end{} 
} 

Set-ADLockUser 

Answer 1

一個字符串值，不能包含數組，因此

$_.SamAccountName -notcontains $excludeUsers 

將始終評估爲$true。您需要反轉檢查並將參考創建爲一個字符串數組（CSV導入會生成一組自定義對象）。從導入CSV只選擇現場SamaccountName和切換參數應該做你想要什麼：

$excludeUsers = Import-Csv '.\excludeusers.csv' | % { $_.SamaccountName } 
... 
$colUsers | ? { $excludeUsers -notcontains $_.SamAccountName } | ... 

---

作爲一個側面說明，您可以簡化代碼尋找這樣的過時的帳戶：

$myDate = Get-Date '01/01/1601 02:00:00' 
$limit = (Get-Date).AddDays(-30) 

$colObj = Get-ADUser -Filter * -Properties * ` 
    | ? { $_.Enabled } ` 
    | select Name,SamAccountName,@{n="NeedDisabled";e={$true}}, 
     @{n="LastLogon";e={[datetime]::FromFileTime($_.lastLogonTimestamp)}} ` 
    | ? { $limit -gt $_.LastLogon -and $_.LastLogon -ne $myDate } 

Answer 2

這是最後的解決方案......

<# 
    .Synopsis 
    Get All Users in the Domain and check the last logon Date 
    .Example 
    Set-ADLockUser -ReportOnly:$true 
    Get all users that didn't logon for a 30 days and write a report to the current directory 
    .Example 
    Set-ADLockUser -ReportOnly:$false 
    Get all users that didn't logon for a 30 days and disabled them 
    .Description 
    Get All Users in the Domain and check the last logon Date, and exclude some users from a list .\excludeusers.csv 
    .Parameter ReportOnly 
    Specifies if the script is in reportmode or active mode if ReportOnly=$false all the relevant users will lock 
    .Outputs 
    PSObject[] 
    .Notes 
    Name: Set-ADLockUser 
    Author: Ohad Halali 
    Date: 14.07.2013 
    .Link 
    #> 
Function Get-ADLockOldUsers { 
param() 
begin{ 
    [datetime]$myDate = '01/01/1601 02:00:00' 
    $colObj = @() 
    $AllUsers = (Get-ADUser -Filter * -Properties lastLogonTimestamp | ? {$_.Enabled} | ` 
       Select Name,SamAccountName,@{N="LastLogon";E={[datetime]::FromFileTime($_.lastLogonTimestamp)}}) | ` 
       ? {(Get-Date).AddDays(-30) -gt $_.LastLogon -and -not ($_.LastLogon -eq $myDate)} 
} 
process { 
$AllUsers | % { 
     $obj = New-Object psobject 
     $obj | Add-Member noteproperty 'Name' $_.Name -Force 
     $obj | Add-Member noteproperty 'SamAccountName' $_.SamAccountName -Force 
     $obj | Add-Member noteproperty 'LastLogon' $_.LastLogon -Force 
     $obj | Add-Member noteproperty 'NeedDisabled' $true -Force 
     $colObj += $obj 
     } 
} 
end { return $colObj } 
} 

Function Set-ADLockUser { 
param([bool]$ReportOnly=$true) 
begin{ 
    if (Test-Path '.\excludeusers.csv') { 
     $excludeUsers = Import-Csv '.\excludeusers.csv' 
     $colUsers = Get-ADLockOldUsers | ? {$excludeUsers.SamAccountName -notcontains $_.SamAccountName} 
     if ($ReportOnly) { 
      $colUsers | Export-Csv '.\Report.csv' -NoClobber -NoTypeInformation -Encoding ASCII -Force 
      } 
     else { 
       $colUsers.SamAccountName | Set-ADUser -SamAccountName $_ -Enabled:$False -Replace @{info="Disabled after no login for 30 days (Script)"} -WhatIf 
      } 
     } 
    else { Write-Output "Error! excludeusers.csv cannot be found, stop script"; break } 
    } 
process {} 
end{} 
} 

Set-ADLockUser