26

I've noticed that we have in Active Directory more users than the company has actual employees.

Is there a simple way to check multiple Active Directory accounts and see if there are any accounts that have not been used for a while? This should help me determine whether some accounts should be disabled or deleted.

1
  • If you use the AD Snapin in the MMC, and you are able to view the user object, then you will get a tab for "attribute editor" in which you can see the attribute for "lastLogin".
    – bgmCoder
    Sep 9, 2015 at 2:27

6 Answers 6

23

O'Reiley's Active Directory Cookbook gives an explanation in chapter 6:

6.28.1 Problem: You want to determine which users have not logged on recently.

6.28.2 Solution

6.28.2.1 Using a graphical user interface

  1. Open the Active Directory Users and Computers snap-in.
  2. In the left pane, right-click on the domain and select Find.
  3. Beside Find, select Common Queries.
  4. Select the number of days beside Days since last logon.
  5. Click the Find Now button.

6.28.2.2 Using a command-line interface

dsquery user -inactive < NumWeeks >

To get more information, see recipe 6.28

4
  • 1
    +1 I have been avoiding weeding the AD because I didnt know how. Thanks.
    – cop1152
    Jun 6, 2009 at 16:12
  • Don't count on outdated accounts always being inactive. Often "test" accounts are created for use by unit tests or as secondary accounts for valid users. These accounts may not appear to be inactive but should be deleted as they provide unaudited access to systems.
    – Chris Nava
    Jun 8, 2009 at 3:55
  • 1
    This only works if the forest/domain is 2003 Native or above, by the way. Before 2003 the DC had its own record of the last login for each user. Dumpsec (mentioned below) is pretty goood to get last true logon by spamming each domain controller and puts together a list of who logged in when on each DC.
    – marty
    Aug 3, 2009 at 7:48
  • @marty Hopefully, not too many pre-2003 installs left, as Server 2003 is end of life.
    – Joel Coel
    Dec 7, 2015 at 19:17
6

This script originated from http://synjunkie.blogspot.com/2008/08/powershell-finding-unused-ad-accounts.html ; this URL no longer works as of Dec 7 2015. You can output this info to a CSV file, which you can view/filter in Excel.

get-qaduser * -sizelimit 0 | select -property name,accountexpires,pass*,accountisdisabled,lastlog*,canonicalname | export-csv -path d:\Passwords.csv
3
  • Assuming you don't want #Type blah blah blah at the beginning of your CSV file, use the -notype parameter on export-csv
    – northben
    Jan 17, 2013 at 16:40
  • URL is broken. :(
    – Signal15
    Aug 31, 2015 at 17:24
  • The URL is broken but you can still access an archive of it: Powershell - Finding Unused AD Accounts
    – PeteWiFi
    Dec 7, 2015 at 16:53
3

It's worth noting that the last logon time stored on each domain controller isn't replicated between domain controllers, there are in fact two attributes that store the last logon time, one is replicated but only every 14 (I think). If an accurate time is important to you I would use a third part tool that queries each domain controller (we have 90!), we've used a tool called True Last Logon, I can recommend it.

0

I use DumpSec, a freeware tool from Somarsoft for this: DumpSec Usefull to find stale computer accounts :)

0

As you go through this process, document it, with both the steps you run, and the accounts you disable/delete. At some point an auditor will ask you how you remove old accounts, and you'll need the documentation.

0

A very quick and dirty method/suggestion:

Set each suspected account's password to expire and require reset upon next login. Place an asterisk in the description field of each account. Wait a week or so, re-check your flagged accounts to see which ones still need the password reset. Disable the offenders, wait for helpdesk calls, re-enable the ones that were on vacation.

Another one:

Alternately you could also send a list of suspected users to your HR/personnel department and see if any of them will verify that they are in fact, still employed.

One more:

Finally, I believe that if you open "Active Directory Users and Computers" and expand the AD Query tool, you can create a query that details what you're looking for.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .