Prerequisite: Since both the Search-ADAccount and Search-ADAccount cmdlets are part of the Active Directory PowerShell module, you will need to import the module to your domain controller using the following command:
Import-Module ActiveDirectory
1. Open the PowerShell ISE on any of your domain controllers→ Run one of the scripts below, paying close attention to the properties used:
Using the Get-ADUser cmdlet:
Get-ADUser -Filter {(Enabled -eq $False)} -ResultPageSize 2000-ResultSetSize $null -Properties Name, LastLogon | Export-CSV “C:\Temp\DisabledUsers.CSV” –NoTypeInformation
Using the Search-ADAccount cmdlet:
Search-ADAccount –AccountDisabled –UsersOnly –ResultPageSize 2000 –ResultSetSize $null | Select-Object SamAccountName, DistinguishedName | Export-CSV “C:\Temp\DisabledUsers.CSV” –NoTypeInformation
2. Open the file produced by the script in MS Excel.

If you want to see the results in command prompt output instead, drop the Export-CSV portion of the script.
- Run Netwrix Auditor → Navigate to “Reports” → Expand the “Active Directory” section → Go to “Active Directory – State-in-Time” → Select “User Accounts” → Click “View” → Set the “Status” parameter to “Disabled” → Click “View Report”.
- To save the report, click the "Export" button → Choose a format from the dropdown menu → Click “Save”.
