Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have around 70 current employees, but 178 accounts in ActiveDirectory. The prior administrators never removed old accounts, and sometimes they weren't even disabled.

As it is, I am considering manually reviewing each account to determine if it can be removed. Is there an easier way to remove accounts based on a condition? Such as, remove (or at least disable or flag in some way) users that haven't logged in within the last month or so?

share|improve this question

3 Answers 3

up vote 5 down vote accepted

You can use dsquery to locate inactive users:

dsquery user -inactive 10 -limit 0

Should return all users inactive for 10 weeks or more.

From dsquery user /?

...
-inactive <NumWeeks>    Finds users that have been inactive
                        (not logged on) for at least <NumWeeks>
                        number of weeks.
...

You can pipe the output into dsrm if you want to remove the listings from the domain. Please note this will not bother prompting you so apply the appropriate amount of caution.

dsquery user -inactive 10 -limit 0 | dsrm -noprompt

See this somewhat related question: http://serverfault.com/questions/118743/removing-old-computers-on-a-domain/118761#118761

share|improve this answer
    
Woops, I guess I used the wrong search terms. Thank you! –  Jason Taylor Mar 25 '10 at 15:24
    
@Jason: The process is essentially the same for users or computers. dsquery does offer options for each object type. Check "dsquery /?" for more details. –  jscott Mar 25 '10 at 15:26

If you just run the dsquery in the context of a called batch file with more than one object selected from your dsquery, you'll get "dsmove failed (user) is an unknown parameter".

I have two batches (one for computer accounts and one for user accounts) that run monthly from windows sch tasks. They have the following code:

For Computers:

    for /f "Tokens=*" %%s in ('dsquery computer -inactive 5 -limit 0') do ( 
DSMOVE %%s -newparent "OU=Computers,OU=Quarantine,OU=MyOu,DC=MyDomain,DC=local" 
) 

For Users:

        for /f "Tokens=*" %%s in ('dsquery user -inactive 5 -limit 0') do ( 
DSMOVE %%s -newparent "OU=Users,OU=Quarantine,OU=MyOu,DC=MyDomain,DC=local" 
) 

I have GPOs applied to those "Quarantine" OUs that have logon prompts to notify the user that the user account, or the computer account, is going to be deleted and to contact the Help Desk if they believe that is in error. The GPOs also do some lock down actions. Then I review the moved objects for manually delete if I don't see any exceptions (like a user on a long vacation, or offline, but important server).

You can change the "do" dsmove to dsrm, if you want to skip the OU move and review.

See here: http://serverfault.com/questions/121288/active-directory-script-dsmove-failed

share|improve this answer

If you are a fan of Powershell, I'd visit www.quest.com and use their suite of tools for Active Directory. They're free.

PowerShell Commands for Active Directory

The ActiveRoles Management Shell for Active Directory is a set of PowerShell commands that can be used to perform and automate administrative tasks like discovering the AD environment, changing user properties, modifying group membership, provisioning new user accounts, and performing multiple other tasks within Active Directory.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.