Powershell脚本禁用非激活AD用户创建日志和发送电子邮件

Question

一个同事找到我，让我创建一个PowerShell脚本来做以下事情:

脚本将读取名为"Temp Associates"的AD安全组的lastlogondate，禁用从当前日期算起的lastlogondate>或= 29天的帐户，并移动到Disabled OU。当它禁用时，它也会将描述更改为禁用日期。然后创建一个列出禁用用户的报告，并通过电子邮件发送给我们的全球帮助台。

我编译了一些看起来应该工作的东西，但是没有。当我运行脚本时，我没有收到任何错误消息，并且生成的日志文件没有填充任何数据。为了保持SOX兼容，我应该能够为测试目的操纵$PasswordAge = (Get-Date).adddays(-29)中的值，因为我不确定我们目前是否有任何满足要求的帐户。

电子邮件正在工作，只是必须创建PSCredential在send-mailmessage -credential参数中使用。

我绝对是PowerShell的新手，可以使用我能得到的所有帮助。任何改进现有代码或使用不同方法的建议都是受欢迎的，但如果可能的话，我想利用我已经拥有的。

下面的代码:

#import the ActiveDirectory Module
Import-Module ActiveDirectory
#Create a variable for the date stamp in the log file
$LogDate = get-date -f yyyyMMddhhmm
#Sets the OU to do the base search for all user accounts, change for your env.
$SearchBase = "CN=Temp Associates,OU=Res Accounts,DC=our,DC=domain,DC=org"
#Create an empty array for the log file
$LogArray = @()
#Sets the number of days to disable user accounts based on lastlogontimestamp and pwdlastset.
$PasswordAge = (Get-Date).adddays(-29)
#Use ForEach to loop through all users with pwdlastset and lastlogontimestamp greater than date set. Also added users with no lastlogon date set. Disables the accounts and adds to log array.
#Add the properties you will be using to ensure they are available.
$DisabledUsers = (Get-ADUser -searchbase $SearchBase -Properties samaccountname, name, distinguishedname -filter {((lastlogondate -notlike "*") -OR (lastlogondate -le $Passwordage)) -AND (enabled -eq $True) -AND (whencreated -le $Passwordage)} )
if ($DisabledUsers -ne $null -and $DisabledUsers.Count > 0) {
    ForEach ($DisabledUser in $DisabledUsers) {
        #Sets the user objects description attribute to a date stamp. Example "11/13/2011"
        set-aduser $DisabledUser -Description ((get-date).toshortdatestring()) -whatif
        #Disabled user object. To log only add "-whatif"
        Disable-ADAccount $DisabledUser -whatif
        #Create new object for logging
        $obj = New-Object PSObject
        $obj | Add-Member -MemberType NoteProperty -Name "Name" -Value $DisabledUser.name
        $obj | Add-Member -MemberType NoteProperty -Name "samAccountName" -Value $DisabledUser.samaccountname
        $obj | Add-Member -MemberType NoteProperty -Name "DistinguishedName" -Value $DisabledUser.DistinguishedName
        $obj | Add-Member -MemberType NoteProperty -Name "Status" -Value 'Disabled'
        #Adds object to the log array
        $LogArray += $obj
    }
    # Move disabled users in Temp Associates group to Disabled OU 
    Search-ADAccount –AccountDisabled –UsersOnly –SearchBase “CN=Temp Associates,OU=Res Accounts,DC=our,DC=domain,DC=org”  | 
    Move-ADObject –TargetPath “OU=Disabled,DC=our,DC=domain,DC=org” -WhatIf
    #Exports log array to CSV file in the temp directory with a date and time stamp in the file name.
    $logArray | Export-Csv "C:TempUser_Report_$logDate.csv" -NoTypeInformation
    #Create PSCredential for use in e-mail -credential parameter
    $secpasswd = ConvertTo-SecureString "PasswordHere" -AsPlainText -Force
    $mycreds = New-Object System.Management.Automation.PSCredential ("UserHere", $secpasswd)
    #Send e-mail to Global Helpdesk with report generated
    $emailFrom = "[e-mail]"
    $emailTo = "[e-mail]" 
    $subject = "NA Disabled Temp Users to be deleted" 
    $smtpServer = "smtp.address.com"
    $attachment = "C:TempUser_Report_$logDate.csv"

    Send-MailMessage -To $emailTo -From $emailFrom -Subject $subject -SmtpServer $smtpServer -attachment $attachment -credential $mycreds
}else {
    Write-Output "No disabled users to process for $PasswordAge."
    #Create PSCredential for use in e-mail -credential parameter
    $secpasswd = ConvertTo-SecureString "PasswordHere" -AsPlainText -Force
    $mycreds = New-Object System.Management.Automation.PSCredential ("UserHere", $secpasswd)
    #Send e-mail to Global Helpdesk with report generated
    $emailFrom = "[e-mail]"
    $emailTo = "[e-mail]" 
    $subject = "NA Disabled Temp Users to be deleted" 
    $smtpServer = "smtp.address.com"
    $attachment = "C:TempUser_Report_$logDate.csv"
    Send-MailMessage -To $emailTo -From $emailFrom -Subject $subject -Body "No disabled users to process for $PasswordAge." -SmtpServer $smtpServer -credential $mycreds
}

Answer 1

把它作为一个答案，即使它不是一个直接的答案。

很难说出什么是错的，特别是当你没有实现任何检查的时候。一种基本的调试策略是在此过程中添加一些输出，以查看脚本是否击中了部分。例如:write-output "Entering Foreach"和write-output "Looping user $($DisabledUser.samaccountname)"，以确保脚本正确执行。这将有助于确定打嗝的位置。

或者，我首先要看的是您的Get-ADUser查询。单独运行它并确保它返回用户。如果不是，让它返回预期的结果

这是你的代码的修改版本，如果没有返回用户，有一个错误检查。

#import the ActiveDirectory Module
Import-Module ActiveDirectory
#Create a variable for the date stamp in the log file
$LogDate = get-date -f yyyyMMddhhmm
#Sets the OU to do the base search for all user accounts, change for your env.
$SearchBase = "CN=Temp Associates,OU=Res Accounts,DC=our,DC=domain,DC=org"
#Create an empty array for the log file
$LogArray = @()
#Sets the number of days to disable user accounts based on lastlogontimestamp and pwdlastset.
$PasswordAge = (Get-Date).adddays(-29)
#Use ForEach to loop through all users with pwdlastset and lastlogontimestamp greater than date set. Also added users with no lastlogon date set. Disables the accounts and adds to log array.
#Add the properties you will be using to ensure they are available.
$DisabledUsers = (Get-ADUser -searchbase $SearchBase -Properties samaccountname, name, distinguishedname -filter {((lastlogondate -notlike "*") -OR (lastlogondate -le $Passwordage)) -AND (enabled -eq $True) -AND (whencreated -le $Passwordage)} )
if ($DisabledUsers -ne $null -and $DisabledUsers.Count > 0) {
    ForEach ($DisabledUser in $DisabledUsers) {
        #Sets the user objects description attribute to a date stamp. Example "11/13/2011"
        set-aduser $DisabledUser -Description ((get-date).toshortdatestring()) -whatif
        #Disabled user object. To log only add "-whatif"
        Disable-ADAccount $DisabledUser -whatif
        #Create new object for logging
        $obj = New-Object PSObject
        $obj | Add-Member -MemberType NoteProperty -Name "Name" -Value $DisabledUser.name
        $obj | Add-Member -MemberType NoteProperty -Name "samAccountName" -Value $DisabledUser.samaccountname
        $obj | Add-Member -MemberType NoteProperty -Name "DistinguishedName" -Value $DisabledUser.DistinguishedName
        $obj | Add-Member -MemberType NoteProperty -Name "Status" -Value 'Disabled'
        #Adds object to the log array
        $LogArray += $obj
    }
    # Move disabled users in Temp Associates group to Disabled OU 
    Search-ADAccount –AccountDisabled –UsersOnly –SearchBase “CN=Temp Associates,OU=Res Accounts,DC=our,DC=domain,DC=org”  | 
    Move-ADObject –TargetPath “OU=Disabled,DC=our,DC=domain,DC=org” -WhatIf
    #Exports log array to CSV file in the temp directory with a date and time stamp in the file name.
    $logArray | Export-Csv "C:TempUser_Report_$logDate.csv" -NoTypeInformation
    #Send e-mail to Global Helpdesk with report generated
    $emailFrom = "[e-mail]" 
    $emailTo = "[e-mail]" 
    $subject = "NA Disabled Temp Users to be deleted" 
    $smtpServer = "smtp.server.com"
    $attachment = "C:TempUser_Report_$logDate.csv"

    Send-MailMessage -To $emailTo -From $emailFrom -Subject $subject -SmtpServer $smtpServer -attachment $attachment
}else {
    Write-Output "No disabled users to process for $PasswordAge."
}

Answer 2

我发现if中的代码从未执行过。您必须将$DisabledUsers.Count > 0替换为$DisabledUsers.Count -gt 0