How to not to enable the user accounts in one specify OU or sub OU?

hi.

i know how find disable user account , enable user account in ous except few specific ous.

i had search similar article: 

http://social.technet.microsoft.com/forums/scriptcenter/en-us/6952a6d2-1532-4b2d-9927-b34cbc5982fb/ldap-searching-excluding-an-ou-from-the-search?forum=itcg

and

http://community.spiceworks.com/topic/243375-ad-search-that-excludes-a-ou

i had try use ldap code link, unable query out sub ou want though had change searchscope 'subtree'. because company used server 2008, can used adsi ldap use powershell , information out active directory.

$objsearch = new-object directoryservices.directorysearcher  $datenow = get-date  $domaindns = "server2008.com" #server 2008  $adpath = [adsi]"ldap://$domaindns/ou=test ou,dc=server2008,dc=com"      $objsearch.filter = "(&(objectclass=user)(objectcategory=person)(samaccountname=test*)"  $objsearch = $objsearch | {$_.properties.item("samaccountname") -notlike "*power shell test*"} #power shell test sub ou , parent contain test ou   write-host "objsearch" $objsearch  $objsearch.searchroot = $adpath  $objsearch.pagesize = 1000  $objsearch.searchscope = "subtree"   $objresults = $objsearch.findall()    foreach($objresult in $objresults){   $objuser = $objresult.getdirectoryentry()  $objuser.samaccountname        if ($objuser.samaccountname -notin "ou=power shell test"){      $objuser.samaccountname      }  }

regards

noobycy

hi.

i know how find disable user account , enable user account in ous except few specific ous.

i had search similar article: 

http://social.technet.microsoft.com/forums/scriptcenter/en-us/6952a6d2-1532-4b2d-9927-b34cbc5982fb/ldap-searching-excluding-an-ou-from-the-search?forum=itcg

and

http://community.spiceworks.com/topic/243375-ad-search-that-excludes-a-ou

i had try use ldap code link, unable query out sub ou want though had change searchscope 'subtree'. because company used server 2008, can used adsi ldap use powershell , information out active directory.

$objsearch = new-object directoryservices.directorysearcher $datenow = get-date $domaindns = "server2008.com" #server 2008 $adpath = [adsi]"ldap://$domaindns/ou=test ou,dc=server2008,dc=com"   $objsearch.filter = "(&(objectclass=user)(objectcategory=person)(samaccountname=test*)" $objsearch = $objsearch | {$_.properties.item("samaccountname") -notlike "*power shell test*"} #power shell test sub ou , parent contain test ou  write-host "objsearch" $objsearch $objsearch.searchroot = $adpath $objsearch.pagesize = 1000 $objsearch.searchscope = "subtree"  $objresults = $objsearch.findall()  foreach($objresult in $objresults){  $objuser = $objresult.getdirectoryentry() $objuser.samaccountname      if ($objuser.samaccountname -notin "ou=power shell test"){     $objuser.samaccountname     } }

regards

noobycy

get-aduser -filter 'name -like "*"' -searchbase "ou=finance,ou=useraccounts,dc=fabrikam,dc=com" | disable-adaccount

---

enfo zipper
christoffer andersson – principal advisor
http://blogs.chrisse.se - directory services blog

Windows Server  >  Directory Services