Powershell assistance for Active Directory Cleanup

Question

I just started a contract to clean up an Active Directory system for a large company. I was told it would be quite the busy work but after reviewing the system and seeing how disorganized and messy it is, I realized that I will not be able to perform my duties to their fullest. Essentially this company has far too many accounts that are not active but cannot be deleted just yet. I want to perform a "Scream Test" for certain accounts and delete later. If this was only a few thousand inactive accounts it would be one story but unfortunately it is quite a few thousand (I haven't taken an exact number yet but it is over 20,000). I was curious if anyone knew of a way to sort through this information in an automated fashion other than using Hyena to get reports and then going through them one by one.

Answer 1

I'll presume your question lies in finding inactive accounts.

I use JoeWare's Oldcmp tool. http://www.joeware.net/freetools/tools/oldcmp/index.htm still after all these years.

It can find inactive AD accounts by looking at password age and specifically LLTS = lastLogonTimestamp

It's simple enough to at least get you started and easier than powershell. Then disable those accounts and use ADUC to create a custom query window for disabled accounts. That way you don't have to move anything that might need re-enabled later.

BUT...I agree with Hopeless and Mfinni, and would say you better clearly lay out what you plan on doing with management BEFORE implementing anything.

Answer 2

I use Powershell to do so, calling the lastlogondate propertie.

Here i return all samaccountname that have a last logon date older than 30 days (from today) :

$datenow = Get-date
$treshold=$datenow.AddDays(-30)
$users=Get-ADuser -Filter * -properties samaccountname,lastlogondate
foreach($user in $users) {
  $lastlogon = $user.lastlogondate
  if($lastlogon -lt $treshold) { 
    echo $user.samaccountname
    echo $user.lastlogondate
    echo "------------------------------------------------"
  }
}

From here, you can :

• Adjust the date treshold to your needs
• Disable the AD Account (Disable-ADAccount)
• Whatever else you want (at least, most of things)

Answer 3

Good advice above re: change control and documenting permissions. I would try an approach like this

Build an inventory of account that includes attribute like lastLogonTimestamp, pwdLastSet, whencreated and whenchanged. You can grab all of this with Powershell and get-ADUser. I'm sure lots of script exist around the web - the TechNet Script repository is a good place to start

Use the inventory to locate target accounts.

Before you make an changed to AD, consider testing everything in a test environment. There are some scripts in the repository that will allow you to make a copy of AD (OUs, Users & groups) into your test environment.

Answer 4

I did a simliar task a few years back, though on a much smaller scale than you're facing. The first thing we did was to implement ManageEngine's AD Audit product in order to get a handle on accounts. We probably let this run for a few weeks in order to generate metrics before we did anything further. From there, we were able to track down where account logins were coming from, and we were able to deal with them in a controlled fashion.

AD Audit is a fairly low-cost product and the excel reports are quite good so we were very happy with our decision to go with it.

Answer 5

Here are some solutions below. Not too sure if it's what you are looking for.

Example #1: This will search the OU Users in the domain domain.local using the date specified. You can change these below and output the Username and LastLogonTimestamp like:

User1

13/2/2014

User2

12/12/2013

Import-Module Active Directory
$lastdate = "09 April 2014 23:59:59"
$users = Get-ADUser -Filter * -SearchBase "ou=users,dc=domain,dc=local" -ResultPageSize 0 -Prop CN,lastLogonTimestamp | Select     CN,@{N='lastlogontimestamp'; E={[DateTime]::FromFileTime($_.lastlogontimestamp)}}
foreach ($user in $users) {
if ($user.lastlogontimestamp -lt $lastdate) {
echo $user.CN
echo $user.lastlogontimestamp.tostring('d/M/yyyy')
}
}

Example #2: This will search the OU Users in the domain domain.local. Then Export it to a CSV then you can see your data a bit better.

Import-Module ActiveDirectory
Get-ADUser -Filter * -SearchBase "ou=users,dc=domain,dc=local" -ResultPageSize 0 -Prop CN,lastLogonTimestamp | Select    CN,@{N='lastLogonTimestamp'; E={[DateTime]::FromFileTime($_.lastLogonTimestamp)}} | Export- CSV -NoType .\last.csv

With Example 2 you could draw up a list of users you are going to remove/disable in CSV / Excel and go to the Management with these.

Hope this helps!

Answer 6

As many others have mentioned TEST before making any changes, especially when scripting or making production changes in AD.

I would look into the free Active Directory module (it's actually a Snap-in) from Quest

The Quest cmdlet Get-QADUser includes various acocount-inactivity related paratmers such as -Inactive,-InactiveFor,-ExpiredFor,-NotLoggedOnFor and -PasswordNotChangedFor that allow you to easily report inactive accounts based on values supplied to these parameters. I suggest downloading the module and using Get-Help Get-QADUser -Full | more or if you have the ISE installed, I prefer Get-Help Get-QADUser -Show to get all the details in a separate window.

An example could be:

Get-QADUser -ExpiredFor 30 -NotLoggedOnFor 30 -PasswordNotChangedFor 90 | Select-Object Name,SamAccountName,PasswordLastSet,PasswordIsExpired,LastLogonTimestamp,AccountIsExpired | Sort-Object Name | Export-CSV C:\InactiveADUsers.csv -NoTypeInformation -Force

You can get very similar output using the native AD module with a bit more elbow grease.