How to Manage User Accounts in Active Directory. Part 3: Enabling, Disabling and Setting Expiration Period for Accounts

Users are one of the most popular objects in AD. They are used for authentication and authorization onworkstations. Also, in many services which are integrated with AD. User management is the main routine for sysadmins and helpdesk specialists. This guide helps to manage such objects in multiple ways. For managing users there is a need to install RSAT tools or manage them from your DC. You have to be signed under domain admin or an Account Operators user or with delegation rights to create objects in the current OU.

Cloud Servers from €4 / moIntel Xeon Gold 6254 3.1 GHz CPU, SLA 99,9%, 100 Mbps channelTry

How to Enable and Disable a User Account in Active Directory

If you want to stop a user logging into their workstation you can disable it, but you need it again for some reason, for example, an employee returned from maternity leave, you can enable it again. Here is the guide to do that in multiple ways.

Enabling and Disabling a User Account Using Active Directory Users and Computers

To enable/disable a user in ADUC, follow these steps:

In ADUC (dsa.msc). Determine the OU or container storing needed accounts. Rightclick it and select Find.... In the Name field, type the name of the user account and then click Find Now... From the list of Search results, select the needed user object, right-click it and select Enable account or Disable account depending on what you need right now and click OK.

Enabling/Disabling a User Account Using cmd.exe

These tasks are for dsmod.exe, use it with the following settings to enable an account.

And this will disable it:

Enabling and Disabling a User Account Using Windows PowerShell

Here is the PowerShell code to enable a user account:

And this one is for disabling a user account:

How to Set Account Expiration Period to a User Account

User accounts can be set to automatically expire after certain period of time.

Setting Account Expiration Period in ADUC

To set account expiration in ADUC, follow these simple steps:

In ADUC (dsa.msc) go to the OU or container with needed user account. Rightclick it and select Find.... In the Name field, type the name of the user account and then click Find Now... From the list of Search results, select the needed user object. Right-click it and select Properties. Select the Account tab, at the bottom of this tab, change the Never option for “Account expires:” to End of:, and select needed date. Click OK to save the changes.

Setting Account Expiration Period Using cmd.exe

Use the dsmod.exe to set the quantity of days before an account expires:

Setting Account Expiration Period Using Windows PowerShell

To set user expiration period in Employees OU execute the following PowerShell script:

Cloud Servers from €4 / moIntel Xeon Gold 6254 3.1 GHz CPU, SLA 99,9%, 100 Mbps channelTry