PowerShell Genie

Disable-ADAccount

Use Disable-ADAccount to disable an Active Directory user or computer account, blocking sign-in while keeping the object.

Command 2 min read Windows PowerShell 5.1 and PowerShell 7

Documentation: Microsoft Learn — Disable-ADAccount

Written and tested by Dhrub Bharali · Updated

Syntax

1PS> Disable-ADAccount [-Identity] <ADAccount> [-Server <String>] [-Credential <PSCredential>] [-PassThru] [-WhatIf] [<CommonParameters>]
See the command anatomy

Inspect this authored example with fictional data in the bounded browser model. The numbered stages show how its objects change.

Get-ADUser -Identity jsmith -Properties Enabled | Select-Object Name, Enabled
  1. Stage 1Get-ADUser-Identity -Properties
  2. Stage 2Select-ObjectPositional values or no named parameters

    Try it

    Windows PowerShell

    PowerShell example · browser support is limited.

    Execution scope: The full example below requires PowerShell outside this browser. You can edit this runner to use the supported practice commands; unsupported syntax returns an explanation.

    Interactive simulation · fictional data

    Examples

    Disable-ADAccount -Identity jsmith

    1PS> Disable-ADAccount -Identity jsmith -PassThru
    Show reference output

    Sample output · fictional data, shaped like the real thing

    DistinguishedName : CN=John Smith,OU=Users,DC=corp,DC=local
Enabled           : False
GivenName         : John
Name              : John Smith
ObjectClass       : user
SamAccountName    : jsmith
UserPrincipalName : jsmith@corp.local

    Get-ADUser -Filter 'Department -eq "Contractors"'

    1PS> Get-ADUser -Filter 'Department -eq "Contractors"' | Select-Object Name # read first
    Show reference output

    Sample output · fictional data, shaped like the real thing

    Name
----------
Jane Smith
Alex Jones

    Get-ADUser -Identity jsmith

    1PS> Get-ADUser -Identity jsmith -Properties Enabled | Select-Object Name, Enabled
    Show reference output

    Sample output · fictional data, shaped like the real thing

    Name        Enabled
----------  -------
Jane Smith  True
Alex Jones  True

    Parameters

    Parameter definitions:

    • -Identity
    • -Server
    • -Credential
    • -PassThru
    • -WhatIf

    Disable-ADAccount on Microsoft Learn

    Practical use and troubleshooting

    Practical scenario: Use Disable-ADAccount when you need to disable an Active Directory user or computer account, blocking sign-in while keeping the object. Start with one identified target and inspect the returned values before extending the operation to a list. Keep the identity in your report so you can trace each result back to the object or path that produced it.

    Common error and fix: Access denied indicates missing rights on the directory object. Resolve the exact account, inspect delegation and verify the enabled flag after an authorised change. In an unattended script, capture this failure with its original error record and record which target failed. An empty result and an unsuccessful query must remain distinguishable in the final report.

    See also: Enable-ADAccount. Enable-ADAccount changes the enabled flag to allow account use; Disable-ADAccount disables the account. Neither operation is the same as unlocking a temporarily locked account. Read the linked command before substituting it; similar names do not imply identical inputs or output.

    Disable-ADAccount reference on Microsoft Learn

    Recap

    Disable-ADAccount Use Disable-ADAccount to disable an Active Directory user or computer account, blocking sign-in while keeping the object.

    Next: Enable-ADAccount
    Genie guideDisable-ADAccount

    Use Disable-ADAccount to disable an Active Directory user or computer account, blocking sign-in while keeping the object. The console below is pre-loaded — run it, then change a value and run it again.

    Explore PowerShell Genie

    Related