WSH: блокировка учетных записей, неактивных более 30 дней

for /f "Tokens=*" %a in ('dsquery user "dc=domain,dc=com" -scope subtree -inactive 4') do dsmove %a -newparent "ou=inactive,dc=domain,dc=com"

Set GroupObj = GetObject("WinNT://MYDOMAINCONTROLLER/Users")

Attribute    Syntax    Count    Value(s)    
lastLogon    Integer8    1    0x0    
logonCount    Integer    1    0

Attribute    Syntax    Count    Value(s)    
lastLogon    Integer8    1    22.11.2007 17:25:30    
logonCount    Integer    1    835

LastLogin = new Date (USER.LastLogin)

Attribute    Syntax    Count    Value(s)    
lastLogon    Integer8    1    0x0

dtLastLogon = objUser.LastLogin

dtLastLogon = objUser.Get("LastLogin")

' Retrieve last login time using all domain controllers in default domain.
'  This script will run unmodified in any domain as it retrieves the current domaion context automatically.
'
'  Returns a sorted list of accounts and logins.
'
'

' errors turned off as we are not handling any errors.
Option Explicit
'On Error Resume Next
Dim bTrace

' uncomment next line to see trace output.
'bTrace = true
Dim oRoot
Set oRoot = GetObject("LDAP://rootDSE")
Dim sDomain
sDomain = oRoot.Get("defaultNamingContext")
Dim strLDAP
strLDAP  = "LDAP://OU=Domain Controllers," & sDomain

Const ADS_SCOPE_SUBTREE = 2

Dim objDict
Set objDict = CreateObject("Scripting.Dictionary")

Dim objConnection,objCommand, objRSServers
Set objConnection = CreateObject("ADODB.Connection")
Set objCommand = CreateObject("ADODB.Command")
objConnection.Provider = "ADsDSOObject"
objConnection.Open "Active Directory Provider"
Set objCommand.ActiveConnection = objConnection

objCommand.Properties("Page Size") = 500
objCommand.Properties("Searchscope") = ADS_SCOPE_SUBTREE
objCommand.Properties("Sort On") = "sAMAccountName"

'Get servers.
objCommand.CommandText = _
    "SELECT sAMAccountName,adsPath FROM '" & strLDAP & "' WHERE objectCategory='computer'"
Set objRSServers = objCommand.Execute

Dim strDC
Do Until objRSServers.EOF
   strDC = objRSServers.Fields("sAMAccountName").Value
   GetUsers Left(strDC, Len(strDC) -1 ), objDict
   objRSServers.MoveNext
Loop


' retrieve sorted values
dim arr, i, j, temp, usr

arr = objDict.Keys()

for i = UBound(arr) - 1 To 0 Step -1
    for j= 0 to i
        if arr(j)>arr(j+1) then
            temp=arr(j+1)
            arr(j+1)=arr(j)
            arr(j)=temp
        end if
    next
next
for each usr in arr
   WScript.Echo "User account:" & usr & "  last login at " & objDict(usr)
next

Function GetUsers( strDC, oDict )
Dim objCommand, objConnection, objRSUsers, dLastLogin
Set objConnection = CreateObject("ADODB.Connection")
Set objCommand = CreateObject("ADODB.Command")
objConnection.Provider = "ADsDSOObject"
objConnection.Open "Active Directory Provider"
Set objCommand.ActiveConnection = objConnection

    'Get users.
    WScript.Echo "Working on " & strDC
   objCommand.CommandText = _
       "SELECT sAMAccountName, lastLogon FROM 'LDAP://" & strDC & "' WHERE objectCategory='user'"
   Set objRSUsers = objCommand.Execute

   Do Until objRSUsers.EOF
      With objRSUsers
         If Not IsNull( .Fields("lastLogon").Value ) then
            dLastLogin = getLast( .Fields("lastLogon").Value )
            if Not oDict.Exists(.Fields("sAMAccountName").Value) Then
               Trace "ADDING:" & .Fields("sAMAccountName").Value & "  Time: " & dLastLogin
               objDict.Add .Fields("sAMAccountName").Value, dLastLogin
            Else
               If oDict(.Fields("sAMAccountName").Value) < dLastLogin Then
                  Trace "UPDATING:" & .Fields("sAMAccountName").Value
                  oDict(.Fields("sAMAccountName").Value) = dLastLogin
               Else
                  Trace "<<<<<<<<<<SKIPPING:" & .Fields("sAMAccountName").Value
               End If
            End If
         End If
         objRSUsers.MoveNext
      End With
   Loop

End Function

Function getLast( last )
Dim intLastLogonTime
   intLastLogonTime = last.HighPart * (2^32) + last.LowPart
   intLastLogonTime = intLastLogonTime / (60 * 10000000)
   intLastLogonTime = intLastLogonTime / 1440
   getLast = intLastLogonTime + #1/1/1601#
End Function

Function Trace( str )
   if bTrace then
      WScript.Echo str
   end if
End Function

' END OF SCRIPT
'
WScript.Stdin.ReadLine

if (objDict(sAMAccountName) < dLastLogin ) {

var Stdout = WScript.Stdout;
var Stdin  = WScript.Stdin;
var objDict = new ActiveXObject("Scripting.Dictionary");
var objConnection = new ActiveXObject("ADODB.Connection");
var objCommand = new ActiveXObject("ADODB.Command");
var oRoot = GetObject("LDAP://rootDSE");
var sDomain = oRoot.Get("defaultNamingContext");

var strLDAP  = "LDAP://OU=Domain Controllers," + sDomain;
var ADS_SCOPE_SUBTREE = 2;
var space = '                                                                                                                                       ';
var strDC, temp, arr

// Формируем запрос на поиск всех серверов домена ========================
objConnection.Provider = "ADsDSOObject";
objConnection.Open("Active Directory Provider");

objCommand.ActiveConnection = objConnection;
objCommand.Properties("Page Size") = 500;
objCommand.Properties("Searchscope") = ADS_SCOPE_SUBTREE;
objCommand.Properties("Sort On") = "sAMAccountName";
objCommand.CommandText = "SELECT sAMAccountName,adsPath FROM '" + strLDAP + "' WHERE objectCategory='computer'";
// =======================================================================

// Выполняем запрос
var objRSServers = objCommand.Execute;

// Перебираем все найденные серверы и добавляем юзеров в глобальный
// для сценария словарь objDict (в функции GetUsers)
while ( !objRSServers.EOF ) {
   strDC = objRSServers.Fields("sAMAccountName").Value;
   GetUsers(strDC.substr(0, strDC.length-1 ));
   objRSServers.moveNext()
}

// сортируем логины по алфавиту
arr = (new VBArray(objDict.Keys())).toArray();
for (var i = arr.length - 1; i>=0; i--) {
   for (var j= 0; j<i; j++) {
      if ( arr[j]>arr[j+1] ) {
         temp=arr[j+1];
         arr[j+1]=arr[j];
         arr[j]=temp;
      }
   }
}

// Перебираем всех найденных юзверей
var name, lastLogon, age, comment, Item
for (var usr in arr)
{
   name = arr[usr];
   Item = objDict(name);
   lastLogon = Item[0];
   comment = Item[1];

   age = (new Date() - lastLogon)/(86400*1000);
   Stdout.WriteLine( (name+space).substr(0,30) +
                     "Age: "+(age.toFixed(0)+space).substr(0,10)+
                     "Last logon: " +(lastLogon.toLocaleString()+space).substr(0,32)+
                     "Comment: " +comment );
}

Stdout.WriteLine ("\nPress Enter");
Stdin.ReadLine ();


//
// FUNCTIONS
//


// Выбирает всех пользователей на заданном сервере домена в ассоциативный массив
function GetUsers( strDC ) {
var dLastLogin;
var Conn = new ActiveXObject("ADODB.Connection");
var RSUsers = new ActiveXObject ("ADODB.Recordset");
var query = "SELECT sAMAccountName, lastLogon FROM 'LDAP://" + strDC + "' WHERE objectCategory='user'"

   Stdout.WriteLine("Working on " + strDC);

   Conn.Provider = "ADsDSOObject";
   Conn.Open("Active Directory Provider");
   RSUsers.ActiveConnection = Conn;

   for ( RSUsers.Open (query); !RSUsers.EOF; RSUsers.moveNext() ) {

      // Для уникальности имени добавляем к нему имя DC
      sAMAccountName = strDC+": "+RSUsers.Fields("sAMAccountName").Value;

      if ( dLastLogin = RSUsers.Fields("lastLogon").Value ) {
          // сюда попадаем, когда у атрибута есть значение (любое)
          dLastLogin     = getLast(dLastLogin);
         AddToDict(sAMAccountName, dLastLogin, '   Success')
      } else {
         // сюда попадаем, когда атрибута нет значения (<Not Set>)
         AddToDict(sAMAccountName, new Date(1900,0,1,0,0,0), '<Not Set>')
      }
   }
}


// добавляет в ассоциативный массив значение с примечанием
function AddToDict(name, value, comment) {
   if (!objDict.Exists (name) ) {
      objDict.Add ( name, [value, comment] );
   } else {
      if (objDict(name)[0] < value ) {
         objDict(name) = [value, comment];
      }
   }
}

// конвертирует lastLogon, возвращенный запросом к LDAP в удобоваримую дату
// возвращает массив - дату как Date() и дату как число
function getLast( last ) {
var res,
    intLastLogonTime = last.HighPart* (4294967296) + last.LowPart;

   res = intLastLogonTime / 10000;
   res = res - Math.abs((new Date(1601,0,1)).getTime());

   return (new Date(res));
}