Disable User script

Question

all, I have the following disable user script:
Add-PSSnapIn Quest.ActiveRoles.ADManagement
# Get the Current Date 
$COMPAREDATE=GET-DATE 
# Number of Days to check back.    
$NumberDays=60
$OU=contoso.local/'
GET-QADUSER -SizeLimit 0 -SearchRoot $OU | 
#where { $_.LastLogonTimeStamp.AddDays($NumberDays) -gt $CURRENTDATE } |
where { $_.lastlogontimestamp -le (get-date).adddays(-$NumberDays) } | 
Where {$_.ParentContainer -notmatch "$OU/contoso\Service Accounts"} |
DISABLE-QADUSER
I run the following command as a domain admin on a workstation:
c:\Windows\System32\WindowsPowerShell\v1.0>powershell.exe -command "&'c:\scripts\disable.ps1'"
I get a listing of accounts and then:
Disable-QADUser : Access is denied.
At C:\scripts\disable.ps1:21 char:16
+ DISABLE-QADUSER <<<<
    + CategoryInfo          : NotSpecified: (:) [Disable-QADUser], Unauthorize
   dAccessException
    + FullyQualifiedErrorId : System.UnauthorizedAccessException,Quest.ActiveR
   oles.ArsPowerShellSnapIn.Powershell.Cmdlets.DisableUserCmdlet
any ideas why I get this and how to fix it?
thanks

Answer 1

Step by step:
This gets all user accounts:
$users=get-qaduser
This filters an out an single OU.
$users=get-qaduser | where{$_.ParentContainerDN -ne 'ou=Service Accounts,dc=contoso,dc-com'}
Now add the exclusion for the logindate
$users=get-qaduser
|
        Where-Object{$_.ParentContainerDN
-ne 'ou=Service Accounts,dc=contoso,dc-com'}
|
        Where-Object{$_.LastLogon
-lt $oldestdate}
Now check $users to be sure it contains what you want.
Now test to see if you can disable them:
$users | Disable-QADUser -WhaztIf
Try it.
¯\_(ツ)_/¯