last time an AD user has logged in?

Question

I've noticed that we have in Active Directory more users than the company has actual employees.

Is there a simple way to check multiple Active Directory accounts and see if there are any accounts that have not been used for a while? This should help me determine whether some accounts should be disabled or deleted.

Answer 1

O'Reiley's Active Directory Cookbook gives an explanation in chapter 6:

6.28.1 Problem: You want to determine which users have not logged on recently.

6.28.2 Solution

6.28.2.1 Using a graphical user interface

1. Open the Active Directory Users and Computers snap-in.
2. In the left pane, right-click on the domain and select Find.
3. Beside Find, select Common Queries.
4. Select the number of days beside Days since last logon.
5. Click the Find Now button.

6.28.2.2 Using a command-line interface

dsquery user -inactive < NumWeeks >

To get more information, see recipe 6.28

Answer 2

Here's a powershell script which will output this info to a CSV file, which you can view/filter in Excel.

Answer 3

It's worth noting that the last logon time stored on each domain controller isn't replicated between domain controllers, there are in fact two attributes that store the last logon time, one is replicated but only every 14 (I think). If an accurate time is important to you I would use a third part tool that queries each domain controller (we have 90!), we've used a tool called True Last Logon, I can recommend it.

Answer 4

I use DumpSec, a freeware tool from Somarsoft for this: DumpSec Usefull to find stale computer accounts :)

Answer 5

As you go through this process, document it, with both the steps you run, and the accounts you disable/delete. At some point an auditor will ask you how you remove old accounts, and you'll need the documentation.

Answer 6

A very quick and dirty method/suggestion:

Set each suspected account's password to expire and require reset upon next login. Place an asterisk in the description field of each account. Wait a week or so, re-check your flagged accounts to see which ones still need the password reset. Disable the offenders, wait for helpdesk calls, re-enable the ones that were on vacation.

Another one:

Alternately you could also send a list of suspected users to your HR/personnel department and see if any of them will verify that they are in fact, still employed.

One more:

Finally, I believe that if you open "Active Directory Users and Computers" and expand the AD Query tool, you can create a query that details what you're looking for.