powershell - Power Shell script to remove disabled and expired accounts from allusers group in AD -

i'm inherit script apparently takes 14 hours complete. i'm not best @ powershell seems me first step search ad disabled and/or expired user accounts, remove them group , maybe groups. here script;

$expired_disabled_users = get-qadgroupmember -identity allusers -sizelimit 0 | ?{$_.accountisdisabled -eq $true -or $_.accountisexpired -eq $true} $expired_disabled_users | ?{$_.accountisdisabled -eq $true | select name,whenchanged} foreach ($user in $expired_disabled_users) {remove-qadgroupmember -identity allusers -member $user} 

so, don't have quest ad plugins. how speed script using regular module activedirectory in powershell? initial change this, don't have way test don't have rights in domain yet;

$expired_disabled_users = get-aduser -filter * | ?{$_.accountisdisabled -eq $true -or $_.accountisexpired -eq $true} $expired_disabled_users | ?{$_.accountisdisabled -eq $true | select name,whenchanged} foreach ($user in $expired_disabled_users) {remove-qadgroupmember -identity allusers -member $user} 

thanks in advance help!

just convert code use 'activedirectory' module (i don't have quest cmdlets) following.

$expired_disabled_users = get-adgroupmember -identity "allusers" |  get-aduser -properties enabled,accountexpirationdate |         where-object{$_.enabled -eq $false -or ($_.accountexpirationdate -is [datetime] -and $_.accountexpirationdate -lt (get-date))} $expired_disabled_users | where-object {$_.enabled -eq $false} | select name foreach ($user in $expired_disabled_users) {remove-adgroupmember -identity "allusers" -member $user -whatif} 

now.. of course still perform slow since pulling all users active directory , filtering on account status. can't find reference allusers in quest documentation assume group exists in org. speed testing not going use group filter show how filter. have 600 users in ad. not going remove users leave code in -whatif simulate processing. of lost time comes enumerating users. address , should think else ok.

so can approach couple of ways. 1 of faster ways address ldapfilter focus on that.

$groupdn = (get-adgroup "sslvpn_direct_forwards").distinguishedname $secondssince = (get-date).touniversaltime() - (get-date "00:00:00 01/01/1601") |     select-object -expandproperty totalseconds $100nanosecondintervals = ($secondssince * [math]::pow(10, 7)).tostring("0")  $ldapfilter = "(&(memberof=$groupdn)(|(useraccountcontrol:1.2.840.113556.1.4.803:=2)(&(!(accountexpires=0))(accountexpires<=$100nanosecondintervals))))"  get-aduser -ldapfilter $ldapfilter 

some explanation

1. $groupdn distunguishedname of group working with. ldap queries memberof use dn use get-adgroup capture value.
2. know $100nanosecondintervals calculation of 100 nanoseconds intervals since "12:00 january 1, 1601". more detail can found here

3. the $ldapfilter broken in 4 parts. user needs group member of group , account has @ least disabled or expired.

   • (memberof=$groupdn) match group looking for. resulting users have member of group
   • (useraccountcontrol:1.2.840.113556.1.4.803:=2) means useraccountcontroll bit enabled not set ( think have explanation right).
   • (!(accountexpires=0))(accountexpires<=$100nanosecondintervals) explained account having expiry value set , accompanying date occurred in past..... expired account

show down

i cant accurately measure command in question reasons mentioned should able idea of how stack against eachother primary query of users.

1..20 | %{     measure-command{         get-aduser -filter * -properties enabled,accountexpirationdate  | where-object{$_.enabled -eq $false -or ($_.accountexpirationdate -is [datetime] -and $_.accountexpirationdate -lt (get-date))}      } }| select -expand totalseconds | measure-object -sum   1..20 | %{     measure-command{         get-aduser -ldapfilter $ldapfilter -properties enabled,accountexpirationdate,memberof | select name,accountexpirationdate,enabled     } }| select -expand totalseconds | measure-object -sum  

lets run 2 commands 20 times each , see how long take together. first users , filter expired or disabled accounts. second use ldap accounts matching same criteria previous.

sum      : 13.0219249  sum      : 1.6220821 

as can see second query (ldap) took less 2 seconds compare 13 first 1 took.

in short i'm tired , should try use , ldap query given criteria , appears large org.