title: Powershell to get the AD user that was disabled in the past 6 months confusion?
body: <p>I wanted to know which command or script that can be used or customized to search for the AD user account that was disabled in the past 6 months?</p>
  
  <p>Script 1: Not sure how to customize this script below since it is quite complex.</p>
  
  <pre><code># When an account is disabled, the userAccountControl attribute is set to 514. 
  # Therefore, with Get-ADReplicationAttributeMetadata to find out when that attribute was the last set
  
  $disabledUsers = Get-ADObject -Filter "ObjectClass -eq 'User' -and userAccountControl -eq '514'"
  
  foreach ($disabledUser in $disabledUsers)
  {
      Get-ADReplicationAttributeMetadata $disabledUser -Server localhost |
      Where-Object { $_.AttributeName -eq 'UserAccountControl' } | Select Object, LastOriginatingChangeTime |
      Where-Object { $_.LastOriginatingChangeTime -gt (Get-Date).AddDays(-180) }
  }
  </code></pre>
  
  <p>Script 2: I was able to use this script and getting all the column &amp; filtering I need, however, it <strong>does not show the AD account that was disabled in the past 6 months</strong>? </p>
  
  <pre><code>Import-Module ActiveDirectory
  $domainDN = (Get-ADDomain).DistinguishedName
  
  $excludeOUs = @(
      'OU=Shared Mailbox'
      'OU=Company Leaver'
  ) | ForEach-Object { $_ + ',' + $domainDN }
  
  $Past = -180
  $Days = (Get-Date).AddDays($Past)
  $ResultPath = "C:\TEMP\ADLastLogonPast_$($Past)_Days.csv"
  $properties = @('Name', 'mail', 'physicalDeliveryOfficeName', 'DisplayName', 'title', 'SamAccountName', 'CanonicalName', 'lastlogondate')
  $filter = { (LastLogonDate -notlike '*' -or LastLogonDate -le $Days) -and (passwordLastSet -le $Days) -and (enabled -eq $True) -and (PasswordNeverExpires -eq $false) -and (whenCreated -le $Days) }
  
  Get-ADUser -properties $properties -Filter $filter -SearchBase $domainDN |
  Select-Object DisplayName,
                Title,
                PhysicalDeliveryOfficeName,
                UserPrincipalName,
                LastLogonDate,
                @{ n = 'LastLogonDaysAgo'; e = { [int]((Get-Date) - $_.LastLogonDate).TotalDays } },
                @{ n = 'CN'; e = { Split-Path $_.CanonicalName -Parent } },
                @{ n = 'ParentContainer'; e = { $_.DistinguishedName -replace '^CN=.*?(?=CN|OU)' } } | Where-Object {
                    ($_.SamAccountName -notmatch '^(Calendar|Room|Account|Fax|Team|Office|Test|User|SM_|HealthMailbox|SVC)$') -and
                    ($excludeOUs -notcontains $_.ParentContainer)
                } |
  Export-Csv -NoTypeInformation -Path $ResultPath
  </code></pre>