I've created a script to compare a list of users from a MSSQL database against a list of disabled AD users. The tool we use for AD authentication returns data in the following format (with plenty more whitespace in between the columns), so to allow the compare (in python) the data needs to be parsed:

User info (Level-2):
Name:                         domain\username
UPN:                          UserName@domain.local
Generated UPN:                NO
DN:                           DN....
Uid:                          123456
Gid:                          123456
Gecos:                        User Name
Shell:                        /shell/path
Home dir:                     /homedir
Other attributes:         ....
Other attributes:         ....
Account disabled (or locked): TRUE
Other attributes:         ....
Other attributes:         ....
Other attributes:         ....

From the command line, the following does the trick, however it's very messy and I'm hoping someone may be able to suggest a cleaner method. I've experimented with awk but haven't had much success in reducing the size of the command:

/opt/util/enum-users --level 2 |
grep "Name:\|Account disabled (or locked): TRUE" |
grep -x "Account disabled (or locked): TRUE" -B 1 |
grep "Name:" |
sed -r 's/^.{35}//'

This outputs the data as required:


2 Answers 2


I don't know if it is more efficient, but you could do this entirely in awk:

awk -F': *' '$1 == "Name" {name = $2; next}; 
$0 == "Account disabled (or locked): TRUE" {
   print gensub(/.*\\/, "", 1, name)
  • clever use of awk separators. +1 Jan 5, 2015 at 13:59

You should just do this with sed entirely since you're using it anyway:

/opt/util/enum-users --level 2 |
sed -n '/^Name:/h;//,/^Account/{

I don't actually know how the [[:blank:]] business should be handled, but the assumption made above is that an interesting line group will probably start like:

^Name:[[:blank:]]*[INFORMATION YOU WANT]$

...and that the next occurring line beginning with the string Account should end with the string TRUE followed by any number of blanks and that an uninteresting group will probably have FALSE or something.

  • Thanks mikeserv. The only thing this didn't do was strip the "domain\", however it was a great help. Jan 6, 2015 at 13:35
  • @PaulDundee - I wasn't aware it should strip the domain. If that is the case you can just add a s/@.*// after the substitution statement already there. Oh, but move the p.
    – mikeserv
    Jan 6, 2015 at 13:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.