title: Power Shell script to remove disabled and expired accounts from allusers group in AD
body: <p>I'm about to inherit this script that apparently takes 14 hours to complete. I'm not the best at PowerShell but it seems to me that the first step is to search AD for disabled and/or expired user accounts, then remove them from that group and maybe all groups. Here is the script;</p>
  
  <pre><code>$expired_disabled_users = Get-QADGroupMember -Identity allusers -SizeLimit 0 | ?{$_.AccountIsDisabled -eq $true -or $_.AccountIsExpired -eq $true}
  $expired_disabled_users | ?{$_.accountisdisabled -eq $true | select Name,whenChanged}
  foreach ($user in $expired_disabled_users) {Remove-QADGroupMember -Identity allusers -Member $user}
  </code></pre>
  
  <p>So, I don't have the Quest AD Plugins. How would I speed this script up using regular Module Activedirectory in Powershell? My initial change is something like this, but I don't have a way to test this as I don't have rights in the domain yet;</p>
  
  <pre><code>$expired_disabled_users = Get-ADUser -Filter * | ?{$_.AccountIsDisabled -eq $true -or $_.AccountIsExpired -eq $true}
  $expired_disabled_users | ?{$_.accountisdisabled -eq $true | select Name,whenChanged}
  foreach ($user in $expired_disabled_users) {Remove-QADGroupMember -Identity allusers -Member $user}
  </code></pre>
  
  <p>Thanks in advance for help!</p>