Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Need a way to automatically identify and disable accounts after 90 days of inactivity. The environment is Windows Server 2008 and Active Directory is not used. I find scripts to doing this when AD is used but nothing otherwise.

share|improve this question
Do you simply mean local/builtin user accounts on the server? – Univ426 Jun 13 '12 at 21:46
how many servers? – tony roth Jun 13 '12 at 22:11
how about looking at the profile file ntuser.dat check the date on it. I think that may be the only way. – tony roth Jun 13 '12 at 22:16
@tonyroth users can still authenticate (shares/etc) without touching their ntuser.dat file. – Hyppy Jun 13 '12 at 22:17
yep if they are not loggin in locally you are correct. – tony roth Jun 13 '12 at 22:18

There is no built-in mechanism to do this with local accounts.

If I wanted to do something like this without using AD, I would build some kind of script to check for the user popping up in the security event log in the last 90 days.

share|improve this answer

There is a powershell module in the technet repository for local user mgmt. I have not worked with it, but it appears to do what you need. It can be found here:
This snippet might get you started:

get-localuser mypc\greg |select name,lastlogin  

Name                LastLogin                                                
----                ---------                                                
Greg                6/13/2012 6:35:56 PM
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.