I encountered a challenge today that was fun to fix.  There’s an Organizational Unit in my AD setup that has historically been used to store disabled AD objects instead of deleting them.

When an employee leaves the organization, our standard procedure  is as followed:

1. Disable User Object
2. Move to separate OU (IE AD://internal.msd/disabled/users)
3. Update Description field with something like: Disabled by [username] on [date]
4. Retain user object for x amount of days, then tombstone it.

Best laid plans of mice and men… yada yada…

Continue reading “Use PowerShell to Update Specific AD User’s Description Field with Last Login Time”