PowerShellHow to disable an Active Directory account using PowerShell

How to disable an Active Directory account using PowerShell

Compromised user accounts can expose organizations to significant security risks. Verizon's 2025 Data Breach Investigations Report found that stolen credentials initiated 31% of all breaches across 12,195 confirmed incidents, making rapid account remediation a critical part of incident response. One of the first steps administrators often take is disabling the affected account to prevent unauthorized access.

This article explains how to enable an AD account using PowerShell and also using ADManager Plus, an integrated Active Directory, Office 365 and Exchange management and reporting tool. It also demonstrates how ADManager Plus is the easier option compared to PowerShell to disable AD accounts.

Windows PowerShell

Steps to disable an AD account using PowerShell.

Ensure you have the necessary permissions to perform this action, and also to execute PowerShell scripts.
Get the value for necessary attributes like the the sAMAccountName, distinguished name (DN), SID, or GUID, to uniquely identify the required account.
Create the script using the Disable-ADAccount cmdlet, and execute it in the PowerShell window.

A sample PowerShell script to disable an AD account

Copied

Disable-ADAccount -Identity "John Smith"

Click to copy entire script

This script will disable the account with the sAMAccountName John Smith.

ADManager Plus

ADManager Plus offers purpose-built features for every type of AD object. For each object type, it offers an enable/disable option. For example, to disable a user account,

Select the Enable/Disable Users feature, located in User Management.
Select the Disable option, the desired domain, and the names of user accounts to be enabled; you can even import the users list from a CSV file. Click Apply.

Screenshot

Disable Active Directory users in bulk using ADManager Plus

» Start 30-day Free Trial

Limitations of using PowerShell to disable AD accounts

You will not be able to disable AD accounts using PowerShell if you do not have sufficient permissions in Active Directory. With ADManager Plus, users' privileges in native AD or Exchange doesn't have to be elevated to enable AD accounts.
If you wish to enable AD accounts in bulk or use a CSV file to enable multiple AD accounts using PowerShell, the script has to be modified. With ADManager Plus though, as the import CSV option is built-in, you can use the disable users feature to disable just one account or multiple accounts at once.
You must know how to run the scripts from the PowerShell window. ADManager Plus is purely GUI-based, allowing you to perform all management and reporting actions with just mouse clicks from its web-based console.
A small error like a misplaced hyphen, a typo in the LDAP names or lack of sufficient permission to configure even one of the attributes used in the script will lead to errors. As all actions in ADManager Plus are GUI-driven, there is no need to write scripts, eliminating the chances of errors.

Deprovision users in Active Directory in bulk.

Get 30-day free trial.

Embark on your script-free AD management, reporting, and automation journey with ADManager Plus.

Thanks

Your download should begin automatically in 15 seconds. If not, click here to download manually.