I've noticed that we have in Active Directory more users than the company has actual employees.
Is there a simple way to check multiple Active Directory accounts and see if there are any accounts that have not been used for a while? This should help me determine whether some accounts should be disabled or deleted.
-
If you use the AD Snapin in the MMC, and you are able to view the user object, then you will get a tab for "attribute editor" in which you can see the attribute for "lastLogin".– bgmCoderSep 9, 2015 at 2:27
6 Answers
O'Reiley's Active Directory Cookbook gives an explanation in chapter 6:
6.28.1 Problem: You want to determine which users have not logged on recently.
6.28.2 Solution
6.28.2.1 Using a graphical user interface
- Open the Active Directory Users and Computers snap-in.
- In the left pane, right-click on the domain and select Find.
- Beside Find, select Common Queries.
- Select the number of days beside Days since last logon.
- Click the Find Now button.
6.28.2.2 Using a command-line interface
dsquery user -inactive < NumWeeks >
To get more information, see recipe 6.28
-
1+1 I have been avoiding weeding the AD because I didnt know how. Thanks.– cop1152Jun 6, 2009 at 16:12
-
Don't count on outdated accounts always being inactive. Often "test" accounts are created for use by unit tests or as secondary accounts for valid users. These accounts may not appear to be inactive but should be deleted as they provide unaudited access to systems. Jun 8, 2009 at 3:55
-
1This only works if the forest/domain is 2003 Native or above, by the way. Before 2003 the DC had its own record of the last login for each user. Dumpsec (mentioned below) is pretty goood to get last true logon by spamming each domain controller and puts together a list of who logged in when on each DC.– martyAug 3, 2009 at 7:48
-
@marty Hopefully, not too many pre-2003 installs left, as Server 2003 is end of life. Dec 7, 2015 at 19:17
This script originated from http://synjunkie.blogspot.com/2008/08/powershell-finding-unused-ad-accounts.html ; this URL no longer works as of Dec 7 2015. You can output this info to a CSV file, which you can view/filter in Excel.
get-qaduser * -sizelimit 0 | select -property name,accountexpires,pass*,accountisdisabled,lastlog*,canonicalname | export-csv -path d:\Passwords.csv
-
Assuming you don't want
#Type blah blah blah
at the beginning of your CSV file, use the-notype
parameter onexport-csv
– northbenJan 17, 2013 at 16:40 -
-
The URL is broken but you can still access an archive of it: Powershell - Finding Unused AD Accounts– PeteWiFiDec 7, 2015 at 16:53
It's worth noting that the last logon time stored on each domain controller isn't replicated between domain controllers, there are in fact two attributes that store the last logon time, one is replicated but only every 14 (I think). If an accurate time is important to you I would use a third part tool that queries each domain controller (we have 90!), we've used a tool called True Last Logon, I can recommend it.
I use DumpSec, a freeware tool from Somarsoft for this: DumpSec Usefull to find stale computer accounts :)
As you go through this process, document it, with both the steps you run, and the accounts you disable/delete. At some point an auditor will ask you how you remove old accounts, and you'll need the documentation.
A very quick and dirty method/suggestion:
Set each suspected account's password to expire and require reset upon next login. Place an asterisk in the description field of each account. Wait a week or so, re-check your flagged accounts to see which ones still need the password reset. Disable the offenders, wait for helpdesk calls, re-enable the ones that were on vacation.
Another one:
Alternately you could also send a list of suspected users to your HR/personnel department and see if any of them will verify that they are in fact, still employed.
One more:
Finally, I believe that if you open "Active Directory Users and Computers" and expand the AD Query tool, you can create a query that details what you're looking for.