IT-Security Step-by-step

last time an AD user has logged in?

I've noticed that we have in Active Directory more users than the company has actual employees.

Is there a simple way to check multiple Active Directory accounts and see if there are any accounts that have not been used for a while? This should help me determine whether some accounts should be disabled or deleted.

6.28.1 Problem: You want to determine which users have not logged on recently.

6.28.2 Solution

6.28.2.1 Using a graphical user interface
1.Open the Active Directory Users and Computers snap-in.
2.In the left pane, right-click on the domain and select Find.
3.Beside Find, select Common Queries.
4.Select the number of days beside Days since last logon.
5.Click the Find Now button.

6.28.2.2 Using a command-line interface


dsquery user -inactive < NumWeeks >

open "Active Directory Users and Computers" and expand the AD Query tool, you can create a query that details what you're looking for.