SERVER-005 · Script
Disable and Offboard Directory User
Disables departing users' directory accounts and, optionally, removes groups, resets the password and moves them to a disabled OU.
What it does
Works on one or more accounts by name, or on a CSV file with an Identity column. Preview mode (default) logs every step it would take and changes nothing. Apply mode, for each account: 1. Saves the account's current OU, groups, manager and description to a rollback CSV. 2. Disables the account and stamps the description with the offboarding date. 3. Optional steps you turn on: reset the password to a random value, remove group memberships (the primary group stays), clear the manager, hide from address lists, move to -DisabledOU. Accounts in protected admin groups are skipped unless -AllowPrivileged is set.
Requirements
Windows PowerShell 5.1 and the ActiveDirectory module (RSAT). Rights to disable, edit and move the accounts and edit their groups.
How to run it
- Run as: a service account with the directory rights the script lists, or SYSTEM on a domain controller or the server being checked
- Run from: a domain-joined management server or admin workstation with the RSAT tools, as a scheduled task or from your management tool
- Script type: PowerShell 5.1, 64-bit
- User interaction: none; the script never prompts
- Timeout: 30 minutes for large directories or many servers
Settings
| Name | What it does | Options | Default |
|---|---|---|---|
| Mode | Preview (default) or Apply. | Preview, Apply | Preview |
| Identity | Sign-in names (sAMAccountName) of the accounts to offboard. | (none) | |
| CsvPath | CSV file with an Identity column. Used when -Identity is empty. | ||
| DisabledOU | OU to move offboarded accounts into, as a distinguished name. Leave empty to leave them in place. | ||
| RemoveGroups | Remove the account from every group except its primary group. | False | |
| ResetPassword | Set a random password nobody knows. | False | |
| ClearManager | Clear the manager field. | False | |
| HideFromAddressLists | Hide the account from address lists (only where the directory has the mail attribute for it). | False | |
| AllowPrivileged | Also offboard members of Domain Admins, Enterprise Admins, Schema Admins and Administrators. | False | |
| Server | Optional domain controller to use for every change. |
Exit codes
- 0 = All accounts offboarded (or would be, in Preview)
- 1 = Some accounts were not found, skipped or had a failed step
- 2 = Script error (see log)
Testing steps
- Run it first with the mode set to Preview on one test OU, test account or test server. Nothing is changed in that mode.
- Read the log and confirm the planned changes are what you expect.
- Run your chosen settings on the same test target and confirm the result.
- Check the exit code: 0 = OK, 1 = needs attention, 2 = error (see log), 9 = this copy is past its Valid until date.
- Roll out to a small group next, then everyone.
Rollback steps
Preview mode changes nothing. The rollback CSV lists each account's original OU, groups, manager and description. To undo, enable the account, move it back, re-add the groups and restore the description from that file.
Version and change log
| Version | Date | Changes |
|---|---|---|
| 1.0.0 | November 2026 | First release. |