Finding Unused Active Directory Accounts

One of my customers recently asked me for some help developing a script to search his Active Directory for user accounts that hadn't been used for more than 90 days.  He had already found that the get-aduser "LastLogon" parameter was domain controller specific, meaning that whichever DC is responding to the request will tell you when it last authenticated that user account.  Of course, since you have multiple DCs (you do, right!?), that isn't guaranteed to give you their actual last logon time.

So, we put together a script that will get a list of all active AD accounts from a particular OU, then query each DC (filterable to a given site by DC name, if necessary) for each account's last logged in time.  Whichever DC returns the most recent last logged in date is the winner, and that date is stored.  At the end, the script returns a list of all users who haven't logged in to the network in X days (we used 90 days).  The script returns some basic info about the account, including its name, when it did last log in, when it was created, and its description.

As always, this script is presented as is for educational purposes.  While it worked for me in this particular situation, that is no guarantee that it will work for you in your situation.


Popular posts from this blog

vCenter Server Appliance Crash due to Full /Storage/SEAT Partition

Deleting Orphaned (AKA Zombie) VMDK Files

PowerShell Sorting by Multiple Columns