Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I would like to find all unused accounts of the active directory, so I need to see the last access to the domain. I looked into the user properties but I did not find anything. Where can I find this information?

share|improve this question

2 Answers 2

up vote 5 down vote accepted

Open up your AD Users & Computers. Go to Saved Queries. Rightclick > New > Query. Give it an easy to remember name. Click on Define Query. Find > Custom Search > Advanced.

Paste this into the box:

(&(objectCategory=person)(objectClass=user)(lastLogonTimeStamp<=128147796000000000))

Press OK twice. Voila, you now have the accounts that have not logged on since Feb. 1, 2007.

enter image description here

If you want to change the date, change the number in the qry above. You can use this tool for the conversion. Alternative here

share|improve this answer
    
It is needed the Win 2003 domain level, before 2003 compatibility this doesn't work. –  Tobia Jul 17 '12 at 8:06
    
This works in all domains with a functional level 2003 or higher. If you are running anything below 2003 FL, you should consider upgrading ASAP. –  Bart De Vos Jul 17 '12 at 8:08
    
I know i should, but I have to get informations about this upgrade to understand what it will change. –  Tobia Jul 17 '12 at 8:12
    
@Tobia: You can use ADSI edit to check manually, or write your own LDAP script to get the information from an earlier domain FL. The attribute is called lastLogonTimeStamp ... and good luck with that. Might wanna elevate the domain first, then worry about querying AD attributes. –  HopelessN00b Jul 17 '12 at 18:50
    
Thank you HopelessN00b! –  Tobia Jul 18 '12 at 6:35

Try the built-in tools like Active Directory Users, and check for additional columns on your Domain Controller.

Also you can connect to your domain controller with LDAP Administrator or similar tool, so you can see perfectly all the smallest details of the LDAP DB, but some is binary data, so to change anything it's really much better to use Windows Domain Controller tools.

share|improve this answer
    
I did not found anything on additional columns... –  Tobia Jul 17 '12 at 7:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.