Exporting a list of disabled Active Directory users helps with audits, importing, and compliance reporting. In this guide, I’ll show you how to export disabled users to a CSV file using PowerShell and the AD Pro Toolkit. I’ll also cover how to filter by OU and include additional user details in the export.
How to Export Disabled Users with PowerShell
To export a list of disabled users to a CSV with PowerShell use the Get-ADUser cmdlet with the Export-Csv option.
Change the path if needed.
Get-ADUser -Filter {Enabled -eq $false} -Properties DisplayName, LastLogonDate, Description | Select-Object Name, DisplayName, LastLogonDate, Description, DistinguishedName | Export-Csv -Path "C:\reports\DisabledUsers.csv" -NoTypeInformation
CSV disable users example
Export Disabled Users with AD Pro Toolkit
The AD Pro Toolkit lets you export disabled users without writing any PowerShell. You can export users to csv, excel or PDF format.
Browse to Reports > Users Status > Disable Users. Run the report and click the export button.
If you need to include additional user attributes to the export, click the columns button.
How to Find all Disabled Users
If you just need a list of all disable users follow these steps.
PowerShell Method
The quickest way to find all disabled users in Active Directory is with the Search-ADAccount PowerShell cmdlet:
This returns every disabled user account in your domain.
Search-ADAccount -AccountDisabled -UsersOnly | select SamAccountName, UserPrincipalName, Enabled
AD Pro Toolkit Method
The AD Pro Toolkit includes an Active Directory Reporting Tool that makes it easy to list all disable users from Active Directory.
Browse to User Status Reports > Disabled Users. Click “Run Report”
The report gets a list of all disabled users and includes additional details like department, OU, title, account status, last logon date and more.
You can easily customize the report by clicking the “Columns” button.
Download AD Pro Toolkit and try the disabled users report for free.
Find Disabled Users in a Specific OU
To get a list of disabled users from an OU, use the -SearchBase parameter and the distinguishedName value of the OU.
Get-ADUser -Filter {Enabled -eq $false} -SearchBase "OU=Sales,DC=company,DC=com" -Properties DisplayName, LastLogonDate | Select-Object Name, DisplayName, LastLogonDate
This is useful when you need to check a specific department or location without pulling every disabled account in the domain.
Account Disabled Attribute (UserAccountControl)
When a user account is disabled the userAccountControl attribute will change to 514. With PowerShell, you can filter on this attribute to find all disabled users.
get-aduser -filter * -Properties UserAccountControl | where {$_.UserAccountControl -eq 514} | select name, UserAccountControl
The problem with this option is that the UserAccountControl attribute can have different values. For example, if the account is disabled and is set to password never expires the UserAccountControl attribute will be 66050. So, running a search for 514 may not list all disabled user accounts in your domain.
How Long to Keep Disabled AD User Accounts?
The time frame to keep disabled user accounts should be defined by your organization as employee accounts are used by other systems such as HR and payroll. Below are some common practices for handling disabled accounts.
- Policy: Define a policy on how long disabled accounts should be kept before they are deleted. Common practice is to keep disabled accounts for 90-180 days before they are deleted.
- Move Disabled Accounts: Move disabled accounts into an organizational unit called Disabled. This makes it easy to see all the disabled accounts in your AD. It also helps to keep things organized.
- Permissions: When disabling accounts, it’s common practice to remove their group membership. If you do this make sure you backup the users group membership just in case the account needs to be restored.
- Review and Audit: Conduct a regular review (such as monthly) to ensure disabled accounts are getting removed based on your defined policy.
