I know how to get ADUser last logins, but what I really want to know is which OUs have had no users logged in within the last 90 days. The AD has thousands of users in hundreds of company OUs and I want to know which OUs are inactive. Thank you.

  • If you know how to get the last logon for AD users, you can just use that same process to loop through all users and use the resulting information to determine whether or not an OU meets these criteria – Semicolon Jan 2 at 15:30
  • To clarify, you're looking for stale/inactive user accounts. Not inactive OUs. The OU path is a property of each user object. Use the Get-ADUser LastLogonTimestamp attribute to determine active/inactive status. – twconnell Jan 2 at 16:56

$Date = Get-Date
$Date90 = $Date.AddDays(-90)
$OUs = Get-ADOrganizationalUnit -LDAPFilter '(name=*)' -SearchBase 'OU=XX Users,DC=XXX,DC=XXX'
# Check each OU.
ForEach ($OU In $OUs)
    $Base = $($OU.DistinguishedName)
    # Query for all users directly in the OU that have logged on in the last specified number of days.
    # Do not consider any child OUs.
    $ActiveUsers = Get-ADUser -SearchBase $Base -SearchScope OneLevel -Filter {LastLogonDate -ge $Date90}
    If ($ActiveUsers.Count -eq 0)
        # Make sure the OU has at least one user.
        $TotalUsers = Get-ADUser -SearchBase $Base -SearchScope OneLevel -Filter *
        If ($TotalUsers.Count -gt 0) {"OU $Base has no users that have logged on in the last 90 days"}

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.