0

I know how to get ADUser last logins, but what I really want to know is which OUs have had no users logged in within the last 90 days. The AD has thousands of users in hundreds of company OUs and I want to know which OUs are inactive. Thank you.

2
  • If you know how to get the last logon for AD users, you can just use that same process to loop through all users and use the resulting information to determine whether or not an OU meets these criteria
    – Semicolon
    Jan 2, 2020 at 15:30
  • To clarify, you're looking for stale/inactive user accounts. Not inactive OUs. The OU path is a property of each user object. Use the Get-ADUser LastLogonTimestamp attribute to determine active/inactive status.
    – twconnell
    Jan 2, 2020 at 16:56

1 Answer 1

0

$Date = Get-Date
$Date90 = $Date.AddDays(-90)
$OUs = Get-ADOrganizationalUnit -LDAPFilter '(name=*)' -SearchBase 'OU=XX Users,DC=XXX,DC=XXX'
# Check each OU.
ForEach ($OU In $OUs)
{
    $Base = $($OU.DistinguishedName)
    # Query for all users directly in the OU that have logged on in the last specified number of days.
    # Do not consider any child OUs.
    $ActiveUsers = Get-ADUser -SearchBase $Base -SearchScope OneLevel -Filter {LastLogonDate -ge $Date90}
    If ($ActiveUsers.Count -eq 0)
    {
        # Make sure the OU has at least one user.
        $TotalUsers = Get-ADUser -SearchBase $Base -SearchScope OneLevel -Filter *
        If ($TotalUsers.Count -gt 0) {"OU $Base has no users that have logged on in the last 90 days"}
    }
}

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .