What It Does
When someone leaves and their account stays enabled, that's the way in nobody is watching, and the account that gets missed is never the one on the offboarding checklist. This script reads every enabled user account in the OU you point it at, or in the whole domain, and finds the ones whose last sign-in is older than the number of days you give it. An account that has never been signed in at all is judged on the day it was created, because the last sign-in is empty for a new account and for an old one nobody ever used.
For each one it does three things: it disables the account, it appends a line to the description saying who disabled it, when, and how many days it had been idle, and it moves the object into the OU you named. It does not delete anything, it does not change a group membership, and it does not touch a password. An account disabled in error goes back in two clicks; a deleted one is a restore from backup.
Every change is made through ShouldProcess, so running it with -WhatIf prints exactly what a real run would do and writes nothing at all. It writes one object per account to the pipeline, so a run can go straight into a CSV for the client's file.
Before You Run It
- Run it with -WhatIf first, and read the list. Every name on it is somebody who is about to lose access.
- Create the OU you are moving accounts into, and check your group policy does not do something surprising to accounts that land there.
- Put your service accounts and your break-glass account in a group, and name that group with -ExcludeGroup.
- Check LastLogonDate is replicating: it is a replicated attribute and can lag, so read it as not recently rather than not since exactly.
- Agree with the client what happens to a mailbox when its account is disabled, before the first run rather than after it.
