• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1637
  • Last Modified:

Identify AD inactive accounts

I need to identify inactive AD accounts, Win 2003 Server.  After some research, I found the following command: "dsquery user -inactive 1".  Seems as thought this should give me what I need, but I'm getting this error: "Could not run query because you're attached to a domain that does not support this query".  Any thoughts what is causing this, or is there something else I could use to identify inactive accounts? Thanks
0
rww833
Asked:
rww833
  • 4
  • 4
  • 3
1 Solution
 
Toni UranjekConsultant/TrainerCommented:
Hi!

You should convert your domain to from mixed mode to native mode. If you don't have any NT4 BDCs on your network, you can do this in Active Directory Users and Computers, right click domain and select Raise Domain functional level... Change is irreversible.

HTH

Toni
0
 
rww833Author Commented:
Sorry for my ignorance, but how do I determine if I have any NT4 BDC's on my network?
0
 
Toni UranjekConsultant/TrainerCommented:
Hmm, how many DC are in yur network? A re any of them NT 4.0 servers? Check Domain controllers OU in AD. Each computer account has OS version listed in properties.
0
What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

 
rww833Author Commented:
Toni,
I only have 1 active DC and it's Win 2003 Server.  However, in AD Domain Controllers it is still showing 2 NT servers which are no longer on the network.
0
 
Toni UranjekConsultant/TrainerCommented:
If you have only one DC (this is not good idea, you should have at least two) and you are not planning to add any NT4 BDCs (ever) then you can safley raise domain functional level. Obsolete computer accounts can be safely removed, if these NT4 BDCs were properly removed.
0
 
rww833Author Commented:
I misspoke......I do have 2 DC's.  Thanks for your help.
0
 
krzywisCommented:
Best to use Customer query from ADUC and specify the number of days that you want those account not being used for

Kris
0
 
rww833Author Commented:
Kris,
I did a Google search on "ADUC" and the only hit was a product called DSRAZOR.  Is that what you're referring to?  Thanks
0
 
Toni UranjekConsultant/TrainerCommented:
ADUC=Active Director Users and Computers.
0
 
krzywisCommented:
rww833
Sorry, ADUC is Active Directory Users and Computers snap-in in AD as toniur explained above.

You can find it under Administrative Tools. Also you can go to Start-> Run and type in dsa.msc

Hope that helps
Kris
0
 
krzywisCommented:
Btw, best to do that from Domain Controller with Windows 2003 installed... I do not think that custom queries option is available in Windows 2000.

Right click Saved Queries. Go to New->Query, then Define query button, then from the drop down menu "Days since last logon" select number of days since last logon, options are 30, 60, 90 days etc
0

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

  • 4
  • 4
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now