How to Disable Multiple Users in Active Directory

In this guide, you will learn how to disable Active Directory user accounts with PowerShell. I’ll also show you how to disable users with the AD Pro Toolkit and ADUC.

PowerShell Disable AD User

In this example, I will use the Disable-ADAccount command to disable a user.

Step 1: Open PowerShell as Administrator.

Step 2: To disable the user run the command below.

Disable-ADAccount -Identity abbie.peters

If the command is successful it will return to the prompt.

Step 3. To verify the account is disabled run this command. If the account is disabled it will display “False”.

get-aduser -Identity abbie.peters | select Enabled

Option #2 AD Cleanup Tool

In this example, I’ll use the AD Cleanup Tool to disable multiple users. The AD Cleanup Tool is 1 of 19 tools included in the AD Pro Toolkit.

Step 1: Click run to get a list of all users. Optionally click browse to select an OU or group.

Step 2. Select one or multiple accounts and click “Disable”

You will be prompted to confirm that you want to disable the accounts. When completed you can view the account status from the result grid.

How to Disable a User in Active Directory (ADUC)

Using the ADUC console you can easily select one or more user accounts to disable.

To disable a single account just browse to the organizational unit, right-click on the account then select disable Account. 

To disable multiple accounts just hold down the Ctrl key and select multiple accounts then right-click and select Disable Account. In this example, I just randomly selected multiple accounts from the Accounting OU. 

As you can see it is very easy to disable user accounts using the ADUC console. This method works well if you have a few accounts that are in the same OU. If you have a big list of accounts that are in various OUs then you will want to use PowerShell. 

Example 2: Disable AD User Account using PowerShell

In this example, I will show you how to use the PowerShell cmdlet Disable-ADAccount to disable single and multiple user accounts. 

You can identify accounts to disable with one of the following identities.

  • A distinguished name
  • A GUID (objectGUID)
  • A Security Identifier (objectSid)
  • A SAM Account Name (SAMAccountName)

I like to use the SAMAccountName to identify accounts as this is typically the user’s login name. 

In this first example, I will disable the user Abel.Austin with the following command: 

Disable-ADAccount -Identity Abel.Austin

That is all there is to it. Now I will use Get-ADuser to confirm that the account was disabled. 

Get-ADUser Abel.Austin | select name,enabled

Yes, I can see from the command output that the account is now enabled. To disable multiple user accounts using PowerShell see example 3. 

Example 3: PowerShell Script to disable accounts from a text file

You can easily disable multiple user accounts from a text file with the script below. 

Step 1: Create a text file with the list of user names

Here is a screenshot of my text file. Save the text file to the computer that will be running the script. 

Step 2: Copy and run the script in PowerShell

Warning: This will disable all of the accounts you have listed in the text file.

If you saved the text file to a different location than c:\it\users.txt you will need to update the script. 

When you are ready, copy the script below into PowerShell ISE and click run. 

$users=Get-Content c:\it\users.txt
ForEach ($user in $users)
{
Disable-ADAccount -Identity $user
write-host "user $($user) has been disabled"
}

Here is a screenshot of this running in my lab. 

If you want to display all disabled user accounts then check out my guide titled Find disabled Active Directory User accounts

Example 4. Bulk Disable User Accounts with the AD Pro Toolkit

I also created an easy-to-use tool called the AD Cleanup Tool that displays all disabled users as well as expired users and users that have never logged on. 

You can also use the AD Cleanup tool to bulk disable AD user accounts. Search for the accounts you want to disable, then select them and click disable.

If you have questions or comments please post them in the comment section below. 

5 thoughts on “How to Disable Multiple Users in Active Directory”

  1. We have guest users in an AD group “guest users”.
    This users must be able to logon when necessary.
    To be sure this users are disabled by default I want to make a Script to disable the members of the grou[ guest users.
    I want to schedule this script to run every night.

    I be able to create a script to disable one user.
    But I’m not able to run this script in the windows scheduler.
    So I have two questions.
    1. How can I select the users from the user group in the script.
    2. How can I schedule this script

    Reply

Leave a Comment