[This is preliminary documentation and is subject to change. Blank topics are included as placeholders.]

Modifies the Active Directory Domain Services account of the specified user (or users); this modification prevents users from using Microsoft Communications Server 2010 clients such as Microsoft Communicator "14" or Live Meeting. Disable-CsUser restricts only activity related to only Communications Server 2010; it does not disable or remove a user’s Active Directory Domain Services account. After a user account has been disabled, it can be re-enabled by using the Enable-CsUser cmdlet.


Disable-CsUser -Identity <UserIdParameter> [-Confirm [<SwitchParameter>]] [-DomainController <Fqdn>] [-PassThru <SwitchParameter>] [-WhatIf [<SwitchParameter>]]


Parameter Required Type Description




Indicates the Identity of the user account to be disabled. User Identities can be specified by using one of four formats: 1) The user's SIP address; 2) the user's Universal Principal Name; 3) the user's domain name and logon name, in the form domain\logon (for example, litwareinc\kenmyer); and, 4) the user's Active Directory Domain Services display name (for example, Ken Myer). Note that the SAMAccountName cannot be used as an identity because it is not necessarily unique in a forest.

You can use the asterisk (*) wildcard character when using the Display Name as the user Identity. For example, the Identity "* Smith" would return all the users with the last name Smith.






Switch Parameter



Switch Parameter

Prompts you for confirmation before executing the command.



Switch Parameter

Describes what would happen if you executed the command without actually executing the command.

Detailed Description

The Disable-CsUser cmdlet deletes all the attribute information related to Communications Server from an Active Directory Domain Services user account; this prevents the user from logging on to Communications Server. As noted, all the Communications Server-related attributes are removed from an account, including details regarding any policies that have been assigned to that account. You can later choose to re-enable the account by using the Enable-CsUser cmdlet. However, policy information, as well as any other account-related information (such as whether or not the user has been enabled for Enterprise Voice) will have to be re-created. If you want to prevent a user from logging on to Communications Server but do not want to lose this account information, consider using Disconnect-CsUser or Set-CsUser instead. For details about these cmdlets, see the corresponding Help topics.

After an account has been disabled with Disable-CsUser, the affected user will no longer be returned by the Get-CsUser cmdlet. This is because that user no longer has a valid Communications Server account. Instead, to retrieve information for that user account, use Get-CsAdUser.

Return Types

Disable-CsUser does not return a value or object. Instead, the cmdlet configures instances of the Microsoft.Rtc.Management.ADConnect.Schema.ADUser object.


-------------------------- Example 1 --------------------------

Copy Code
Disable-CsUser -Identity "Ken Myer"

The preceding Example disables the Communications Server account for user Ken Myer. In this example, the user's display name is used to indicate his Identity.

-------------------------- Example 2 --------------------------

Copy Code
Get-CsUser -LDAPFilter "Department=Finance" | Disable-CsUser

In Example 2, all the users in the Finance department have their Communications Server accounts disabled. To carry out this task, the command first uses the Get-CsUser cmdlet and the LDAPFilter parameter to return a collection of all the users who belong to the Finance department. That collection is then piped to Disable-CsUser, which disables each account in the collection.

-------------------------- Example 3 --------------------------

Copy Code
Get-CsUser -UnassignedUser | Disable-CsUser

In the preceding Example, all the user accounts not currently assigned to a registrar pool are disabled. To do this, Get-CsUser is called, along with the UnassignedUser parameter. This parameter restricts the returned data to users who have valid user accounts but are not assigned to a registrar pool. (Typically, this means user accounts that have been disconnected using Disconnect-CsUser.) That collection is then piped to Disable-CsUser, which disables each account.