Powershell - Unlock AD Accounts

   One of the first issues I have encountered is when the school year starts and all the students come back.  We reset everyone's password just before school starts to help reduce the forgotten password issues.  While this has shown to reduce password issues, with 2000+ kids, some are bound to forget.  In order to make this quick and simple, I turned to powershell.  While Active Directory Users and Computers(ADUC) is quite easy to unlock accounts, I wanted to make it a little quicker.  Here's what I used:

Search-ADAccount -LockedOut

This command searches through all of Active Directory and returns the accounts locked out.  From there I can run:


Unlock-ADAccount -Identity <SAMAccountName> or <Distinguished Name>

The Search-ADAccount commmand returns the SAMAccountName and Distinguished Name which the Unlock cmdlet can handle either one:

Unlock-ADAccount -Identity AndyE

Unlock-ADAccount -Identity "CN=AndyE,OU=Users,DC=domain,DC=com"


While these are nice for handling one account at a time, I run into situations where there is a line of students outside my door with locked out accounts.

I needed a faster way to to unlock accounts than one at a time.  Luckily, with the pipline symbol I can combine more than one command.  This ultimately led to me using:

Search-ADAccount -LockedOut | Unlock-ADAccount

If you maybe haven't noticed, I prefer one liners to get things done.  I have written fairly complex scripts for creating users and other tasks.  I still prefer the quickest and easiest way to accomplish a task.  I'm sure there are probably more elaborate ways to handle these issues, these commands are what works for me and my environment.