Need a way to automatically identify and disable accounts after 90 days of inactivity. The environment is Windows Server 2008 and Active Directory is not used. I find scripts to doing this when AD is used but nothing otherwise.
-
Do you simply mean local/builtin user accounts on the server?– Univ426Jun 13, 2012 at 21:46
-
how many servers?– tony rothJun 13, 2012 at 22:11
-
how about looking at the profile file ntuser.dat check the date on it. I think that may be the only way.– tony rothJun 13, 2012 at 22:16
-
@tonyroth users can still authenticate (shares/etc) without touching their ntuser.dat file.– HyppyJun 13, 2012 at 22:17
-
yep if they are not loggin in locally you are correct.– tony rothJun 13, 2012 at 22:18
2 Answers
There is no built-in mechanism to do this with local accounts.
If I wanted to do something like this without using AD, I would build some kind of script to check for the user popping up in the security event log in the last 90 days.
There is a powershell module in the technet repository for local user mgmt. I have not worked with it, but it appears to do what you need. It can be found here: http://gallery.technet.microsoft.com/scriptcenter/Local-Account-Management-a777191b.
This snippet might get you started:
get-localuser mypc\greg |select name,lastlogin
Name LastLogin
---- ---------
Greg 6/13/2012 6:35:56 PM