Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've noticed that we have in Active Directory more users than the company has actual employees.

Is there a simple way to check multiple Active Directory accounts and see if there are any accounts that have not been used for a while? This should help me determine whether some accounts should be disabled or deleted.

share|improve this question
add comment

6 Answers

up vote 16 down vote accepted

O'Reiley's Active Directory Cookbook gives an explanation in chapter 6:

6.28.1 Problem: You want to determine which users have not logged on recently.

6.28.2 Solution

6.28.2.1 Using a graphical user interface

  1. Open the Active Directory Users and Computers snap-in.
  2. In the left pane, right-click on the domain and select Find.
  3. Beside Find, select Common Queries.
  4. Select the number of days beside Days since last logon.
  5. Click the Find Now button.

6.28.2.2 Using a command-line interface

dsquery user -inactive < NumWeeks >

To get more information, see recipe 6.28

share|improve this answer
    
+1 I have been avoiding weeding the AD because I didnt know how. Thanks. –  cop1152 Jun 6 '09 at 16:12
    
Don't count on outdated accounts always being inactive. Often "test" accounts are created for use by unit tests or as secondary accounts for valid users. These accounts may not appear to be inactive but should be deleted as they provide unaudited access to systems. –  Chris Nava Jun 8 '09 at 3:55
1  
This only works if the forest/domain is 2003 Native or above, by the way. Before 2003 the DC had its own record of the last login for each user. Dumpsec (mentioned below) is pretty goood to get last true logon by spamming each domain controller and puts together a list of who logged in when on each DC. –  marty Aug 3 '09 at 7:48
add comment

Here's a powershell script which will output this info to a CSV file, which you can view/filter in Excel.

share|improve this answer
    
Excellent use of Powershell - thanks for the tip! –  marc_s Jun 12 '09 at 7:53
    
Assuming you don't want #Type blah blah blah at the beginning of your CSV file, use the -notype parameter on export-csv –  northben Jan 17 '13 at 16:40
add comment

It's worth noting that the last logon time stored on each domain controller isn't replicated between domain controllers, there are in fact two attributes that store the last logon time, one is replicated but only every 14 (I think). If an accurate time is important to you I would use a third part tool that queries each domain controller (we have 90!), we've used a tool called True Last Logon, I can recommend it.

share|improve this answer
add comment

I use DumpSec, a freeware tool from Somarsoft for this: DumpSec Usefull to find stale computer accounts :)

share|improve this answer
add comment

As you go through this process, document it, with both the steps you run, and the accounts you disable/delete. At some point an auditor will ask you how you remove old accounts, and you'll need the documentation.

share|improve this answer
add comment

A very quick and dirty method/suggestion:

Set each suspected account's password to expire and require reset upon next login. Place an asterisk in the description field of each account. Wait a week or so, re-check your flagged accounts to see which ones still need the password reset. Disable the offenders, wait for helpdesk calls, re-enable the ones that were on vacation.

Another one:

Alternately you could also send a list of suspected users to your HR/personnel department and see if any of them will verify that they are in fact, still employed.

One more:

Finally, I believe that if you open "Active Directory Users and Computers" and expand the AD Query tool, you can create a query that details what you're looking for.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.