asked on
unauthorized user accounts in AD
What would your definition of "unauthorized user accounts " in an AD environment? Can you provide an example of the types of accounts and parameters that would flag up such accounts? Out of interest, is there any easy way to list just for domain accounts whose passwords dont exprie - a last login date if it was >50 days ago.
So all domain accounts with password doesnt expire = yes. And last login date.
What procedures do you follow and how often to identify inappropriate user accounts?
So all domain accounts with password doesnt expire = yes. And last login date.
What procedures do you follow and how often to identify inappropriate user accounts?
Microsoft Server OSWindows Server 2008Active Directory
Last Comment
Pau Lo
SOLUTION
THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
ASKER CERTIFIED SOLUTION
THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
ASKER
I dont suppose you could provide a list of all ad user account mgmt reports you run to identify such. Non expiring passwords and last login was just one example Id thought of, was hoping others may chime in with others.
Ideally a free tool was my aim.
Ideally a free tool was my aim.
I primarily look for users who have not logged in for over 60 days. Since we do pretty much control who gets in AD, I'm not as concerned about non-expiring passwords since 99.9% of our users have expiring passwords. Once I identify individuals who meet the above criteria, I check with HR to make sure there's not some HR reason they haven't logged in.
We chose this suite of products because they seemed to be full-featured and not very expensive. You might take a look at Spiceworks: http://www.spiceworks.com/free-active-directory-management-software/
I think this is free, but I've never used it so I can't comment on it's usefulness.
We chose this suite of products because they seemed to be full-featured and not very expensive. You might take a look at Spiceworks: http://www.spiceworks.com/free-active-directory-management-software/
I think this is free, but I've never used it so I can't comment on it's usefulness.
ASKER
adfind seems a good choice to (and free)
So all domain accounts with password doesnt expire = yes. And last login date (wth parameter of over 50 days).