Finding and Disabling Inactive AD User Accounts

howdy list,

Anybody has experience or script to " find and disable Inactive AD User
Accounts for at least 30 or some period of days?

help and suggestion will be appreciated.

jtux,

 

See tip 8260 » How can I report all inactive user accounts, and optionally disable them, even if I have multiple domain controllers?
in the 'Tips & Tricks' at http://www.jsifaq.com

Jerold Schulman
Windows Server MVP
JSI, Inc.
http://www.jsiinc.com
http://www.jsifaq.com

 

http://www.joeware.net/win/free/tools/oldcmp.htm

--
Joe Richards Microsoft MVP Windows Server Directory Services
Author of O'Reilly Active Directory Third Edition
www.joeware.net


---O'Reilly Active Directory Third Edition now available---

http://www.joeware.net/win/ad3e.htm

 

I have a script that will read all users in the domain and list out the last
logon and provide information about each user.

Attributes include:
User Name
Last Logon Date
Creation Date
Home Folder
Script
Display Name
Password Not Needed
Password Does Not Expire
Expired Password
Account Is Disabled

The script can be found at:
http://www.pbbergs.com
Select Downloads and select User Account Attibutes

 

Hello jtux,

There is an attribute called the lastlogontimestamp for each and every user.
You can check for that attribute for all theusers through a script and get
the users who have not logged in for last 30 days.
For more information on that, check out microsoft website with the keyword
lastlogontimestamp.
Cheers,
Gib

 

Hi,

You can user DSQUERY command from command line to get all inactive user
accounts. Format is

dsquery user OU=Employees,dc=contoso,dc=com -inactive 4

This command will query all users who didn't login to domain for the last 4
weeks.

dsmod user cn=username,OU=Employees,dc=contoso,dc=com -disabled yes.

This command will disable given user ID.

You can pipe this to commands and achive your task.

dsquery user OU=Employees,dc=contoso,dc=com -inactive 4 | dsmod user
-disabled yes.

Let me know you need any further help.

Thanks,
Mallika.

 

Yeah this handled much nicer and tremendously safer from oldcmp...
lastLogonTimeStamp and all.

--
Joe Richards Microsoft MVP Windows Server Directory Services
Author of O'Reilly Active Directory Third Edition
www.joeware.net


---O'Reilly Active Directory Third Edition now available---

http://www.joeware.net/win/ad3e.htm

 

Download netwrix inactive users tracker—netwrix offers the tool as part of the identity management suite, and it automatically detects, reports and deactivates all user accounts that have been inactive for a specified number of days. I know they also offer a freeware version that detects and reports on inactive accounts, but doesn’t automatically deactivate them.