I need to pull a clean list of all the active (enabled) user accounts in our Active Directory for an audit, because clicking through Active Directory Users and Computers OU by OU is painful and I keep missing people. I also have a couple of accounts that were disabled by mistake and need turning back on. What is the quickest way to list enabled versus disabled users, and how do I re-enable an account without hunting for it in the GUI?
How to Find and Enable Users in Active Directory with PowerShell
Resolved
Data Recovery
CM
Community Member August 20, 2026
6 replies
1,121 views
Reviewed by moderators
6 Answers
Every AD user object has an Enabled property that is either True (the account is active and can log in) or False (it is disabled and blocked from signing in). In Active Directory Users and Computers a disabled account shows a small downward arrow on its icon, but for auditing a whole domain you want PowerShell, not the GUI.
One prerequisite: you need the ActiveDirectory PowerShell module, which comes with RSAT (Remote Server Administration Tools) or is already present on a domain controller. Import it first with Import-Module ActiveDirectory and the cmdlets below all become available.
To list all enabled users across the domain:
Get-ADUser -Filter {Enabled -eq $true} -Properties Name,SamAccountName | Select-Object Name,SamAccountName,DistinguishedName
And for the opposite, all disabled users:
Get-ADUser -Filter {Enabled -eq $false} | Select-Object Name,SamAccountName,DistinguishedName
Putting the filter in the Get-ADUser -Filter itself is more efficient than pulling every user and filtering afterward, because AD does the work server-side and returns only what you asked for.
For the audit, export the enabled users straight to a CSV your reviewers can open in Excel:
Get-ADUser -Filter {Enabled -eq $true} -Properties Name,SamAccountName,UserPrincipalName,LastLogonDate | Select-Object Name,SamAccountName,UserPrincipalName,LastLogonDate | Export-Csv -Path "C:\Reports\EnabledUsers.csv" -NoTypeInformation
Adding LastLogonDate is handy, it lets the reviewers spot enabled accounts that nobody has actually used in months, which are often the ones that should be disabled.
To re-enable your disabled accounts, use Enable-ADAccount. You identify the account by its SAM account name, distinguished name, GUID or SID:
Enable-ADAccount -Identity jsmith
That is the whole fix for one account. To confirm it worked, check the property afterward:
Get-ADUser jsmith -Properties Enabled | Select-Object Name,Enabled
The counterpart when you need to switch one off is Disable-ADAccount -Identity jsmith, same syntax.
If you have several accounts to enable at once, pipe them in rather than typing each. For example, enable every disabled user in a specific organizational unit:
Get-ADUser -Filter {Enabled -eq $false} -SearchBase "OU=Staff,DC=corp,DC=example,DC=com" | Enable-ADAccount
Or work from a reviewed list: put the SAM account names in a text file, one per line, then Get-Content .\EnableThese.txt | Enable-ADAccount. The same pattern with Disable-ADAccount lets you bulk-disable leavers from a list, which is a common offboarding step.
One caution before you bulk-enable anything: accounts are usually disabled for a reason (someone left, a shared account was retired, a security review flagged it). Re-enabling in bulk can quietly switch dormant or risky accounts back on. So enable only what you have verified, and for the reverse direction, disabling rather than deleting a leaver's account is the safe habit, it blocks sign-in immediately while preserving the account and its group memberships in case you need them back. If this AD syncs to Microsoft 365, note that the enabled or disabled state flows up to the cloud on the next sync, so managing it here is what controls their cloud sign-in too.