Join Us!

Spaces are allowed; punctuation is not allowed except for periods, hyphens, and underscores.
A valid e-mail address. All e-mails from the system will be sent to this address. The e-mail address is not made public and will only be used if you wish to receive a new password or wish to receive certain news or notifications by e-mail.
This question is for testing whether you are a human visitor and to prevent automated spam submissions.
Enter the characters shown in the image.


Enter your Project Envision username.
Enter the password that accompanies your username.
Request new password

Enable and Disable Active Directory Users With dsmod

Are you tired of managing your Windows Active Directory using Active Directory Users and Computers, have a go and try using built-in tools like dsmod, dsquery, dsget to do your routing tasks. I am really surprised that many Windows administrators have not heard them or using them during they daily tasks and prefer to do  everything by hand from dsa.msc. Below post will show how easy and fast is to enable and disable user using dsmod.

From several years we have PowerShell which is the most powerful tool for automating administration of Windows, SQL Server, Exchange and SharePoint. However knowledge of older tools can be beneficial in some situations. So here is a full example: First task: Check if used is disabled We start from finding the user, for this we will use dsquery, which is a tool that can help finding object in active directory, with parameter user, because we are trying to find an object of type user. The last part of the command is a filter, which designated what objects will be returned, in the below example I queried using name attribute.
C:\>dsquery user -name "John*Black"
"CN=John Black,OU=TestUsers,DC=projectenvision,DC=com"

Another handy tool is dsget, it will allow us to read active directory’s object attributes. Below we just want to read if account is disabled

C:\>dsquery user -name "John*Black" | dsget user -dn -disabled
  dn                                                      disabled

  CN=John Black,OU=TestUsers,DC=projectenvision,DC=com    no

Above we pipe output from dsquery to dsget. In dsget we use to parameters –dn, which displays object distinguished name, and –disabled which shows if account is disabled or not.

Second task: Disable user account

Again I am using dsquery to find a user object than we pipe it to dsmod to which we provide “user” as a parameter, because we are going to modify user object, the second parameter in dsmod is –disabled which allows us to change the status of the object by either disabling it or enabling it. In below command we set –disabled yes, which disables the user account

C:\>dsquery user -name "John*Black" | dsmod user -disabled yes
dsmod succeeded:CN=John Black,OU=TestUsers,DC=projectenvision,DC=com

Third task: Confirm that user account was disabled

We use exactly the same command like during first task

C:\>dsquery user -name "John*Black" | dsget user -dn -disabled
  dn                                                      disabled

  CN=John Black,OU=TestUsers,DC=projectenvision,DC=com    yes

dsget succeeded