When a user leaves an organization, which cmdlet is commonly used to disable their account?

Disabling a user account is a common administrative task in Active Directory as it helps maintain security and compliance when a user leaves an organization. The cmdlet "Disable-ADAccount" is specifically designed for this purpose. When executed, it changes the user account's status to disabled, which prevents the user from logging in without deleting the account entirely. This approach retains the user’s information and permissions in the system for future reference or potential reactivation.

Using this cmdlet is crucial as it maintains the integrity of historical data in the directory while ensuring that ex-employees or users no longer have access to the organization’s resources. In contrast, other cmdlets such as "Enable-ADAccount" or "Remove-ADUser" serve different functions, like reactivating a disabled account or deleting a user entirely. "New-ADUser" is for creating a new user account and does not apply to the scenario of managing an existing user's status upon their departure from the organization.