Good afternoon.  
I am the administrator for about 100 different domains and a total of about 15000 users.    Domain functional levels range from 2003 to 2012.

I am currently looking for a way to automate basic level user management.  I have no idea how to script.  I do everything manually and It just isn't working for me any more.  I need a more efficient way to do this.  I need to have the system automatically disable any AD account that has not been logged in for 30 days.   Then I need something to delete  the AD accounts that have been disabled for 30 days.  I need this to be 100% automated.  meaning that  I run it once and never have to look at it again.   I guess I could set something as a scheduled task that runs ever week on the DC.    

On top of the above, I also need something that will delete the users data on the server.   we use folder redirection for some domains and Roaming profiles for other domains.  

I'm looking for an in house solution, no third party tools or programs.  batch file, powershell, or vb script.  Does any one know of any sources I can look at or examples that i may be able to use and piece something together?

Hi,

You can start your search in the repository here:

http://gallery.technet.microsoft.com/scriptcenter

I highly recommend using and learning PowerShell:

http://technet.microsoft.com/en-us/scriptcenter/dd793612.aspx

You have two possibilities/.  Learn to script or hire a consultant.

You are asking for a complete solution.  This is a scripting forum where admins and technicians who are using script or are learning script come for help.  It isnot a place to get free consulting.

Look in the Gallery for scripts.  You will likely find some that can be used or modified to your

This type of enterprise script is a pretty tall order as your first effort.  Before you start deleting AD accounts, I'd recommend picking up a book like "Windows PowerShell 3.0 First Steps" or "Learn Windows PowerShell 3 in a Month of Lunches", to lay down the basic foundation.

When it comes time to write the actual script, I'd keep a couple of things in mind:

• AD doesn't store information about 'when' an account was disabled.  There's just a flag that says it's disabled or it's not.  You'd need to store the date and time somewhere (either in AD, perhaps in the Description field, or in a separate database that your script uses to do its work.)
• Read this blog post on the lastLogonTimestamp attribute; it will be relevant to your code that identifies inactive accounts:  http://blogs.technet.com/b/askds/archive/2009/04/15/the-lastlogontimestamp-attribute-what-it-was-designed-for-and-how-it-works.aspx .  The actual search is easily accomplished using the Search-ADAccount cmdlet.

Hey Guys, 
Thank, this is exactly what i was looking for.  A place to start.