In my last article I wrote about having Ansible run several audit requests including: “We need a list of all inactive user accounts” as well as “We need a list of inactive computer accounts”. Now that we have those listed, we can let Ansible clean those up. I preferred to create a new playbook for these tasks. First it will list the Users and Computers it will be handling first, next it will disable the account, followed by moving it to either the Inactive_Users or Inactive_Computers OU. I never delete the accounts as we prefer to disable, then move them.
Below is my ansible playbook “fix_AD_Inactive-Users-AND-Computers-90days.yml”
---
- hosts: pdc
gather_facts: no
tasks:
- name: copy file to windows
win_copy:
src: files/fix_inactive_usr.ps1
dest: c:\it\fix_inactive_usr.ps1
- name: copy file to windows
win_copy:
src: files/fix_inactive_pc.ps1
dest: c:\it\fix_inactive_pc.ps1
- name: Fix inactive users - 90 days
win_shell: c:\it\fix_inactive_usr.ps1
register: inactive_usr
- debug: var=inactive_usr.stdout_lines
- name: Fix inactive computers - 90 days
win_shell: c:\it\fix_inactive_pc.ps1
register: inactive_computer
- debug: var=inactive_computer.stdout_lines
Below is the code for “fix_inactive_usr.ps1”
$date = (get-date).AddDays(-90)
$USR = (Get-ADUser -Filter {LastLogonDate -lt $date} -Property Enabled | Where-Object {$_.Enabled -like "true"} | Select DistinguishedName).DistinguishedName
echo $USR
ForEach ($Item in $USR){
Disable-ADAccount $Item
Move-ADObject -Identity $Item -TargetPath "OU=Disabled_Accounts,DC=contoso,DC=com"
}
Please note in the PowerShell scripts above and below, you will need to change “DC=contoso,DC=com” to reflect your actual domain
Below is the code for “fix_inactive_pc.ps1”
# Specify inactivity range value below
$DaysInactive = 90
# $time variable converts $DaysInactive to LastLogonTimeStamp property format for the -Filter switch to work
$time = (Get-Date).Adddays(-($DaysInactive))
# Identify inactive computer accounts
$PC = (Get-ADComputer -Filter {LastLogonTimeStamp -lt $time} -Property Enabled | Where-Object {$_.Enabled -like "true"} | Select DistinguishedName).DistinguishedName
echo $PC
ForEach ($Item in $PC){
Disable-ADAccount $Item
Move-ADObject -Identity $Item -TargetPath "OU=Disabled_Computers,DC=contoso,DC=com"
}
