Script Repository


Users disabled during a number of days

April 06, 2022
68

The script generates a report containing user accounts disabled during the specified number of days. For information on creating reports, see the Create Report tutorial.

In the script, the $daysParamNumber specifies the name of the report parameter used to select the number of days. The parameter name should be specified with the param- prefix.

Edit Remove
PowerShell
$daysParamNumber = "param-MyParam" # TODO: modify me

$days = $Context.GetParameterValue($daysParamNumber)

# Bind to the directory object representing the General Log
$path = $Context.GetWellKnownContainerPath("ServiceLog")
$serviceLog = $Context.BindToObject($path)

$generalLog = $serviceLog.GeneralLog
if ($days -ne 0)
{
   $generalLog.StartDateTime = (Get-Date).AddDays(-$days)
   $generalLog.EndDateTime = Get-Date
}

# Get the log records
$log = $generalLog.Log
$records = $log.GetPage(0)

# Build filter to search for disabled users
$guidComparer = $Context.CreatePropertyValueComparer("objectGuid")
$guids = New-Object System.Collections.Generic.HashSet[byte[]] @($guidComparer)

foreach ($record in $records)
{
    if ($Context.Items.Aborted)
    {
        return
    }
    
    if (($record.TargetObjectType -ne "user") -or ($record.TargetObjectGuid -eq $NULL))
    {
        continue
    }
    
    $operationTypes = $record.GetOperationTypes()
    if ($operationTypes -notcontains "disable account")
    {
        continue
    }

    # Get GUID
    $guidBytes = ([Guid]$record.TargetObjectGuid).ToByteArray()
    $guids.Add($guidBytes)
}

$searcher = $Context.CreateGuidBasedSearcher(@($guids))
$searcher.AppendFilter("(userAccountControl:1.2.840.113556.1.4.803:=2)")
$Context.Items.Add($searcher)

Comments ( 0 )
No results found.
Leave a comment