How to Get all Enabled Users in Active Directory

To detect when a user account is enabled or disabled in Active Directory, the Audit User Account Management subcategory within the Account Management audit policy must be enabled. Without enabling this setting , actions like enabling or disabling accounts will not be logged.

Steps to enable Audit User Account Management policy

When the Audit User Account Management policy is enabled, user administration activities are logged in the Security logs. For user account actions, Event ID 4722 is logged when a user account is enabled, and Event ID 4725 is logged when an account is disabled. These logs contain key details about the events, such as who performed the action, when it occurred, and from which machine to help admins track account changes effectively.

Track user account enable/disable events using Event Viewer

• Open Event Viewer on a domain controller and navigate to Windows Logs»Security.
• In the right pane, click Filter Current Log.
• Search for Event IDs 4722 (account enabled) or 4725 (account disabled) to review related user account events.

Check who enabled/disabled a user account using PowerShell

You can use the below PowerShell cmdlets to filter event logs based on user accounts. Replace the <SAMAccountName> with the specific username for which you’re auditing, in the following events:

Event ID 4722: User account enabled

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4722} | Where-Object { $_.Message -match "Target Account:\s+Security ID:\s+[^\r\n]+\s+Account Name:\s+<SAMAccountName>" } | Select-Object TimeCreated, Message | fl

Event ID 4725: User account disabled

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4725} | Where-Object { $_.Message -match "Target Account:\s+Security ID:\s+[^\r\n]+\s+Account Name:\s+<SAMAccountName>" } | Select-Object TimeCreated, Message | fl

To narrow results further, you can filter the logs by the ‘TimeCreated’ attribute based on your requirements to focus on events within a specific timeframe.

Note: Both methods must be performed on the domain controller where the enable or disable action occurred. If your Active Directory has multiple domain controllers, auditing becomes more complex as you need to search for events on each one.

Enabling a disabled user account in Active Directory restores access to network resources. The user can regain access to their data and settings without recreating the account. This is typically done after a temporary disablement for security or administrative reasons.

Enable an Active Directory user using ADUC console

Enable a user account in Active Directory using PowerShell

First, run the below cmdlet to find the SAM account name or the distinguished name of the disabled user account that you want to enable .

Get-ADUser -Filter {Enabled -eq $false} -Properties * | Select-Object Name, SAMAccountName, DistinguishedName

Then, you can use the following PowerShell command to enable a disabled user account by replacing <UserName> with the user's SAM account name or distinguished name.

Enable-ADAccount -Identity "<UserName>"

• The AdminDroid’s account disabled users report lists all disabled users with details such as last logon time, OU name, and more.
• With AdminDroid's management capabilities, you can enable a disabled user directly from the report. To do so, simply select the user(s) and click Enable User.

Pro Tip: To consistently review disabled accounts in Active Directory, schedule (⏰) this report at specific intervals to identify and safely remove accounts that are no longer needed.

User account lockouts in Active Directory occur after multiple failed logon attempts when lockout policies are in place. Admins can unlock these accounts to restore user access. But you might wonder, “Why manually unlock accounts if they unlock automatically after some time?”

The answer lies in organizational policies—some disable automatic unlocks, while others set long delays before unlocking accounts. In such cases, manual unlocking becomes essential, especially in emergencies. Instead of sifting through all locked accounts, filtering only enabled locked accounts streamlines the process, saving admin time and reducing effort.

Find enabled accounts under currently locked out using ADUC console

List all locked out accounts with enabled status in AD using PowerShell

Run the following PowerShell command to find all enabled users currently locked out in Active Directory:

Get-ADUser -Filter {Enabled -eq $true} -Properties "LockedOut" | Where-Object {($_.LockedOut -eq $true)} | Format-Table

The above cmdlet retrieves enabled users who are currently locked out, including details such as distinguished name, name, object GUID, user principal name, and more.