Guy’s Scripting Ezine 86 – LastLogon Property – Part 2

Contents for Ezine 86 – LastLogon Property

• This Week’s Secret
• Scenario: You want to Identify the Delete Old Accounts
• Beware lastLogon
• Example – To Disable, then Move Old Accounts into a Named OU
• Summary of Resetting the Password

 ♣

This Week’s Secret

If I had to give a man-of-the-match award to an element of this week’s script, it would be a tie between WScript.Echo and the construction ‘If…Then… End If’.  My secret for success was to combine WScript.Echo commands with the ‘If’ construction.  As a result I was able to troubleshoot the more powerful sections, for example the sub routine to move the computers or users.

While I have ‘Remmed out most of the WScript.Echo lines in the final script, I retained an unusually high number of ‘If’ statements.  Incidentally, I don’t know how I would have managed without my OnScript VBScript editor, see here menu opposite.

This week’s script is a triumph for vision, believe and perseverance.  In truth, I had forgotten how difficult it was to move an object from one OU to another using a script.  Drag and drop is so easy in the MMC, but to mimic this action with a VBscript is very difficult.

If I have a lingering doubt about this week’s script, it is that although this is a beautiful script, even a work of art, it may not be suitable for teaching purposes.

Guy Recommends 3 Free Active Directory Tools

SolarWinds have produced three Active Directory add-ons.  These free utilities have been approved by Microsoft, and will help to manage your domain by:

1. Seeking and zapping unwanted user accounts.
2. Finding inactive computers.
3. Bulk-importing new users.  Give this AD utility a try, it’s free!

Download your FREE Active Directory administration tools.

Scenario: You want to Identify the Delete Old Accounts

Five readers kindly wrote in suggesting that we disable the accounts before deleting them.  I whole-heartedly agree.  Last week I was so focussed on the lastLogon date that I forgot about ‘best practice’.  In this instance, best practice is to disable the accounts, backup Active Directory, and only then delete the old accounts.

Now the above task is easy to plan, but hard to put into action, especially the section which moves the computer or user objects from one OU to another.  I have extended my usual plea for you to break the script into sections by introducing two sub-routines.  Sub Disable() will handle disabling the accounts, while the Sub MoveUser() moves the disabled user or computer accounts into another OU.

Script to Identify Dormant User and Computer Accounts

There are three goals for this script:

1) To identify all users or computers that are older than 60 days.  (Number of days is controlled by intAging.)

2) To disable these old accounts.

3) To move any disabled accounts into a separate OU.  I admit that in terms of logic, in a production network, this could mean moving accounts that are disabled but not older than 60 days.  My defence is that such points keep you on your toes, and that you or I could amend the script to cater for this loophole.  What I seek is to create scripts that teach you about scripting as well as solving specific problems.

O.K. I confess, the real reason that I have not perfected the script is time, plus a genuine wish not to add yet more complexity to the script.

Prerequisites

This script needs an Active Directory domain, however please note that for safety, this script is designed for a domain with only one Domain Controller.  Best would be to logon as administrator at a domain controller.  My plan B would be to Remote Desktop to a domain controller.

1. Review how the script extracts the lastLogon date – See last week’s ezine.  If necessary, create an extra test route to check the lastLogon value against the value for a known date.
2. Decide what you want to do with objects that match the test, disable them?  Move them, or even both?
3. Talking of objects, you have a decision to make.  Decide whether to run the script for users, computers or both.

Instructions for Creating a VBScript to display lastLogon time.

1. You have not just one variable to amend, but a whole section.  Make sure that you set the SourceOU, and the DestinationOU.  Pay special attention to the type of object ‘Computer’ or ‘Person’ (not user).
2. Create a few new users and new computer in your SoureOU, as these account will never have logged on, they will have lastLogon value of 1/1/1601.  As a result, the script will identify, disable and then move these accounts into strDestinationOU.
3. Copy and paste the example script below into notepad or get a OnScript.
4. One advantage of a good script editor such as OnScript is that you can see the line numbers.
5. Save the file with a .vbs extension, for example: LastLogonMove.vbs 
6. Double click LastLogonMove.vbs and check the message box.

Guy Recommends: The Free IP Address Tracker (IPAT)

Calculating IP Address ranges is a black art, which many network managers solve by creating custom Excel spreadsheets.  IPAT cracks this problem of allocating IP addresses in networks in two ways:

For Mr Organized there is a nifty subnet calculator, you enter the network address and the subnet mask, then IPAT works out the usable addresses and their ranges. 

For Mr Lazy IPAT discovers and then displays the IP addresses of existing computers. Download the Free IP Address Tracker

Example – To Disable, then Move Old Accounts into a Named OU

This example disables all accounts older than 60 days in an OU specified by strSourceOU.  It then moves these filtered accounts into a named OU.  Note my script’s original version number was 5.1, I would not be surprised that in the light of feedback, I amended the script, if so check the version number of the example below.

Learning Points

Note 1:  Firstly, seek information from Remarks in the actual script.

Note 2:  Refresh your memory of the lastLogon attribute in Ezine 85.

Note 3:  The secret of understanding this script is to break it down into four sections.
Note 3a: Amend your variables, beginning with intAging at line 20.
Note 3b: Check the logic of comparing lastLogon with intKeyDate lines 46-59
Note 3c: Realize that userAccountControl = 514 means disable the account.
Note 3d: Examine the MoveUser() sub Routing in great detail.

Note 4:  Make a point of finding, and understanding each of the ‘If…Then…End If’ constructions.

Note 5:  Make a special study of objectCategory line 71 because you can use the ‘Person’ value in other VBScripts.  ObjectCategory is a different LDAP property from objectClass and I use it to distinguish between users and computers.  You could substitute objectClass, but be aware that ‘User’ is a value of both Users and Computers.  Strange but true.  The benefit of objectClass is that you can filter with ‘Computer’ and ‘Person’.  Remember that ‘Person’ is a value held only by User objects.  (Check with ADSI Edit).

Note 6:  I have been smitten with the Split() function, and I employ it here to extract the ‘Person’ or ‘Computer’ value from the objectCategory.   It goes without saying that there are other ways of filtering the objects, but I am taken with Split, and that is what I used to select one type of Active Directory account.

Note 7:  As I hinted earlier, I had forgotten that scripting the process to move users was so difficult.  Regard Sub MoveUser() (line 87) as a ‘black’ box for shovelling disabled objects into a holding pen.  In real life, the idea would be to examine them and check that they were the correct object before running another script to delete these old users or computers.

Note 8: This script also features a one-liner to get today’s date.  Examine the simple but effective date function and see why the script always detects accounts that are older than 60 days from when you run the script.  See line 47:
intDeleteDate = date()-intAging

Summary of Moving Old Accounts

This is an advanced script.  It’s goals are to identify old Active Directory accounts, disable them and finally to move the User or Computer accounts to a different OU.  The second OU acts as a holding pen until you are ready to delete these old objects.

See More Active Directory VBScripts for Passwords

• User Spreadsheet  • Add Users to Groups  • Create Users  • Free CSV Importer

• Ezine 83 Passwords  • Ezine 85 LastLogon  • Ezine 86 LastLogon   • Ezine 122 Passwords

• Ezine 128 IUSR Passwords  • VBScript change password  • Tool Kit  • Ezines