First of all, please note that there is no disabled time stamp attribute in AD.
Having said that, here are some tips to find when an account was disabled in Active directory:
You can use ADSIedit to look at an account’s properties. Scroll all the way down and look at the Attribute called “whenChanged”. This will tell you when the account was disabled.
The only relevant attributes AD records are :
Unfortunately, if any change has been made to the object since it was disabled, this will update whenChanged and modifyTimeStamp. The Attribute “whenChanged” is the more reliable one because it gets replicated to all DCs.
The only other option is to search the event logs. Look at the security logs and filter / search for event ID # 629. This will tell you when the user ID was disabled. It will also tell you who did it.
Here is an interesting KB article. This article contains descriptions of various security-related and auditing-related events, and tips for interpreting them. These events will all appear in the Security event log and will be logged with a source of “Security.”
Another useful script:
How to find user accounts disabled between two dates:
The following script uses dsquery and finds all disabled users that were last modified between Jan 12, 2011, and March 1, 2011:
dsquery * -filter "(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113522.214.171.1243:=2)(whenChanged>=20110112000000.0Z)(whenChanged<=20110301000000.0Z))"