PowerShell Get Disabled Users from Active Directory

Easily get disabled users from Active Directory using PowerShell. I'll also show you how to get when an account was disabled by using the AD Pro Toolkit.

When an employee leaves an organization or the account is no longer needed, the Active Directory user account should be disabled. Overtime your AD environment can compile a large list of disabled user accounts, this can lead to an unwanted mess and possible security threats.

As an administrator it is important to regularly check your AD for disabled user accounts. You can quickly find all disabled users with a simple PowerShell command. If you don't want to mess with PowerShell then I recommend checking out the AD Pro Toolkit which has over 200 built in AD Reports. With the toolkit you can automate disabled user account reports and have it emailed to you or other team members.

Get all Disabled users with PowerShell:
Get-ADUser -Filter {Enabled -eq "False"}

Get All Disabled Users and filter properties:
Get-ADUser -Filter {Enabled -eq "False"} | select name, enabled

Blog Post with more examples:

Active Directory Reporting Tool:

You can include the WhenChanged attribute to help determine when an account was disabled. This attribute will update when the account is disabled but if you go back and make changes to the account the WhenChanged attribute will update.

To export a list of disabled users with powershell use this command: