We help IT Professionals succeed at work.

Find old AD accounts

Medium Priority
417 Views
Last Modified: 2012-05-12
I am looking for a way to find user accounts in AD under a specific OU for old accounts. For example I would like to find accounts that people haven't logged into for the last 6 months
Comment
Watch Question

CERTIFIED EXPERT
Top Expert 2013

Commented:
A few tools that are good for this,  

old computer by Joe Richards is a great one   http://www.joeware.net/freetools/tools/oldcmp/  works for users too and has a lot of safety features

adtidy is a free GUI tool if you prefer the GUI   http://www.cjwdev.co.uk/Software/ADTidy/Info.html

Thanks

Mike
Kent WSr. Network / Systems Admin
CERTIFIED EXPERT

Commented:
I use oldcomp, one up for it.  Mike beat me to the punch :)
Director, Information Systems
CERTIFIED EXPERT
Commented:
In my 2003 Domain, I can go into ADUC, right-click on Saved Queries", select NEW -> QUERY, give it a name and description, select a point in my AD tree for the query to run, click "Define Query" and select 180 in the "Days since last logon" dropdown.

Does that help?  If not, what functional level is your domain?
Bradley FoxLAN/WAN Systems Administrator
CERTIFIED EXPERT

Commented:
Powershell script to show all users and their last logon date.
$dcs = [System.DirectoryServices.ActiveDirectory.Domain]::getcurrentdomain().DomainControllers | select name

$startdate = get-date('1/1/1601')

$lst = new-Object System.Collections.ArrayList
foreach ($dc in $dcs) {
 $root = [ADSI] "LDAP://$($dc.Name):389"
 $searcher = New-Object System.DirectoryServices.DirectorySearcher $root
 $searcher.filter = "(&(objectCategory=person)(objectClass=user))"
 $searcher.PropertiesToLoad.Add("name") | out-null
 $searcher.PropertiesToLoad.Add("LastLogon") | out-null
 $searcher.PropertiesToLoad.Add("displayName") | out-null
 $searcher.PropertiesToLoad.Add("userAccountControl") | out-null
 $searcher.PropertiesToLoad.Add("canonicalName") | out-null
 $searcher.PropertiesToLoad.Add("title") | out-null
 $searcher.PropertiesToLoad.Add("sAMAccountName") | out-null
 $searcher.PropertiesToLoad.Add("sn") | out-null
 $searcher.PropertiesToLoad.Add("givenName") | out-null
 $results = $searcher.FindAll()

 foreach ($result in $results)
 {

  $user = $result.Properties;
  $usr = $user | select -property @{name="Name"; expression={$_.name}},
          @{name="LastLogon"; expression={$_.lastlogon}},
          @{name="DisplayName"; expression={$_.displayname}},
          @{name="Disabled"; expression={(($_.useraccountcontrol[0]) -band 2) -eq 2}},
          @{name="CanonicalName"; expression={$_.canonicalname}},
          @{name="Title"; expression={$_.title}},
          @{name="sAMAccountName"; expression={$_.samaccountname}},
          @{name="LastName"; expression={$_.sn}},
          @{name="FirstName"; expression={$_.givenname}}

  $lst.Add($usr) | out-null
 }
}

 

$lst | group name | select-object Name, 
         @{Expression={ ($_.Group | Measure-Object -property LastLogon -max).Maximum }; Name="LastLogon" },
         @{Expression={ ($_.Group | select-object -first 1).DisplayName}; Name="DisplayName" },
         @{Expression={ ($_.Group | select-object -first 1).CanonicalName}; Name="CanonicalName" },
         @{Expression={ ($_.Group | select-object -first 1).Title}; Name="Title" },
         @{Expression={ ($_.Group | select-object -first 1).sAMAccountName}; Name="sAMAccountName" },
         @{Expression={ ($_.Group | select-object -first 1).LastName}; Name="LastName" },
         @{Expression={ ($_.Group | select-object -first 1).FirstName}; Name="FirstName" },
         @{Expression={ ($_.Group | select-object -first 1).Disabled}; Name="Disabled" } |
     select-object Name, DisplayName, CanonicalName, Title, sAMAccountName, LastName, FirstName, Disabled,
         @{Expression={ $startdate.adddays(($_.LastLogon / (60 * 10000000)) / 1440) }; Name="LastLogon" }

Open in new window

Author

Commented:
what would the command be for users, if i used old computer

Author

Commented:
This is perfect, I was looking for something easy and simple to just find all the accounts that haven't logged in for 6 months.

THank you for this

Explore More ContentExplore courses, solutions, and other research materials related to this topic.