• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 310
  • Last Modified:

Searching Accounts on DC That Havent Been Logged Into For X Amount of Time

What would the dsquery command be if I wanted to search all users that hadn't logged on for say, 3 months that have their account enabled still?

I want to make sure all the accounts in my company have been closed off and havent been left open after they've left.
0
AdamB1988
Asked:
AdamB1988
  • 4
  • 4
  • 3
  • +1
1 Solution
 
MegaNuk3Commented:
Are you specifically looking for a DSQUERY command or will any other option that works be OK?

Have a look at this blog, which talks about using windows powershell and the free Quest cmdlets to do that: http://jonathanmedd.blogspot.com/2009/01/powershell-active-directory-one-liners.html
0
 
AdamB1988Author Commented:
Thanks for this - I'll look into it the Powershell options but a dsquery command would be more easier for me to use :)
0
 
MegaNuk3Commented:
Or a nice VBScript that will even move the accounts to another OU if you want:
http://www.codeproject.com/KB/vbscript/Disable_Stale_AD_Users.aspx 
0
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 
MegaNuk3Commented:
For DSQUERY you are going to need something like this:
dsquery * -filter (&(objectCategory=person)(objectClass=user)(lastLogin<=27604693676718750)) -scope subtree

but working out the LastLogin value is really a pain because it is thenumber of 100 nanosecond intervals since January 1, 1601 (UTC)
http://msdn.microsoft.com/en-us/library/ms676823
0
 
abhijeet11160Commented:
hi ,

check out the ldap query

$adobjroot = [adsi]''
$objdisabsearcher = New-Object System.DirectoryServices.DirectorySearcher($adobjroot)
$objdisabsearcher.filter = "(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=2))"
$resultdisabaccn = $objdisabsearcher.findall() | sort path
0
 
martingagnonCommented:
Hi,  you can use the following sinple DSQuery command

dsquery user -inactive 12

-Inactive : Searches for users who have been inactive (stale) for at least the number of weeks that you specify.

0
 
AdamB1988Author Commented:
Exactly what I wanted
0
 
MegaNuk3Commented:
Thanks martingagnon, never heard of that one... Learn something new everyday.
0
 
AdamB1988Author Commented:
I tried this and it works fine as you cna see by the accepted solution. Is there a way to add in if an account is enabled and been inactive. I know the command is disabled so would it be something like:

dsquery user -inactive 12 disabled no

?
0
 
martingagnonCommented:
Hi

that would do the trick
dsquery user -inactive 12 -disabled

If you want to get the Distinguished name of the account, use this command
dsquery user -inactive 12 -disabled | dsget user -DN

To output to a text file, use the > c:\dsget.txt at the end of the command. exampe:
dsquery user -inactive 12 -disabled | dsget user -DN > c:\inactiveuser.txt

If you want to delete those account without a prompt:
dsquery user -inactive 12 -disabled | dsrm -noprompt
0
 
AdamB1988Author Commented:
Nearly there, that brings up all the users that are disabled. I just want to see enabled accounts that havent been logged onto for say 5 weeks. What is the limit command so it doesnt limit itself to a certain amount?
0
 
martingagnonCommented:
Okay then

dsquery user -inactive  -limit 0 | dsget user -Display -Disabled

The -Limit parameter specifies the number of objects to return that matches the criteria that you specify. If you specify a value of 0  this parameter returns all matching objects. If you do not specify this parameter, dsquery displays the first 100 results by default.  I

The -Disabled parameter displays whether user accounts are disabled for logon (yes) or not (no).



0

Featured Post

Free tool for managing users' photos in Office 365

Easily upload multiple users’ photos to Office 365. Manage them with an intuitive GUI and use handy built-in cropping and resizing options. Link photos with users based on Azure AD attributes. Free tool!

  • 4
  • 4
  • 3
  • +1
Tackle projects and never again get stuck behind a technical roadblock.
Join Now