20 Jun

Find Inactive users in Active Directory using PowerShell Script

in Active Directory, Active Directory Reporting, powershell

Find Inactive users in Active Directory using PowerShell Script. This post is directed at explaining how to find inactive users in Active Directory using PowerShell Script.

Active Directory Reporting

InfraSOS

At the beginning of our article titled Find Inactive users in AD please take a look at InfraSOS. A solution you need to secure, analyze and report on Active Directory and Office 365 users using our SaaS AD reporting solution.

Also Read

Check out our Active Directory Reporting Tool, Office 365 Reports – InfraSOS

InfraSOS Active Directory AD benefits

Audit Active Directory users.
Audit Office365 users.
SaaS platform.
Active Directory Management.
Active Directory Health Check.
Office365 Management.
Azure AD monitoring.
Overview of your Active Directory domain / forests.
Decrease replications of users.
Improve the speed of AD user logons.
DNS monitor.
AD user reporting tools.

Also Read

How to Setup Active Directory Cloud Domain on Azure/AWS/GCP

How are Inactive User Accounts Identified?

A major issue Organizations that deal with large amounts of data have is a security breach. Inactive users in Active Directory can be the cause of major security issues.

It is therefore pertinent that these organizations take the effort to ensure that regular checks are done on their Active Directory. Once inactive users are found in their Active Directory, these users should be disabled.

One of the most common and effective ways of discovering inactive users is through the use of the LastLogonTimeStamp Attribute.

The LastLogonTimeStamp Attribute

This is an attribute which is found in user accounts. This attribute helps us identify inactive user accounts and their computers.

Also, the LastLogonTimeStamp is updated with several logon types, we are concerned with the Interactive logon, as this talks about when someone logs on at a console.

Let’s discover how to see how to locate the LastLogonTimeStamp attribute for a user in Active Directory:

Open a user account
Click on the Attribute Editor Tab
Scroll down the LastLogonTimeStamp field.

Whenever a user is logged on to the Active Directory site, you can make use of the LastLogonDate and LastLogonTimeStamp attributes to check every domain controller and figure out the last date of logon. This can be used as means to identify inactive users.

Also Read

Get Office 365 users with a specific license type via PowerShell

Why Inactive User Accounts in Active Directory should be Identified

As mentioned earlier, there are several reasons why inactive user accounts should be identified and eliminated. Some of the reasons are listed below:

Security reasons: This reason comes up as the foremost because it is the most important. An account that has been dormant or unused for some time is the perfect entry point for a breach of security. It is therefore important for a constant check and control.

Data Integrity: The Active Directory is majorly made up of a centralized database, which holds critical information. The data on the Directory has to be accurate and up to date to avoid errors in other systems connected or working with it.

Licensing and Cost implication: If there are several inactive accounts on Active Directory that are working in synchronization with software that licenses on a per-user bias, the organization will be paying for licenses for users who are not in the use of the license.

Proper management: An Active Directory that is unorganized and littered with irrelevant information will be harder to manage. This is therefore in an organization’s interest to ensure that old users’ information is removed from Active Directory.

Also Read

How to Setup / Configure Domain Password Policy in Active Directory

Using PowerShell Script to Find Inactive User Accounts in Active Directory

Different users have different reasons for wanting to find inactive users. Either for managing the Active Directory database space or reducing security risk issues, either way, this operation has to be carried out.

You have various options when it comes to performing this task. You could navigate through hundreds of names on the Directory to find out whether those that are active or not.

The downside to this option is that it is cumbersome for organizations with a large number of users. Thankfully, there are other options made available. One of them is through the use of PowerShell Scripts. While this option is fast and time saving, it, however, has some technicalities to it and requires expertise to make use of it.

Also Read

Active Directory Bulk Password Reset using PowerShell

Installing the Active Directory Module

We will need the following modules and components installed in our server before we will be able to make use of PowerShell to check for inactive users.

Remote Server Administration Tools (RSAT) for Windows.
Active Directory Module for PowerShell

By, executing the code snippet Install-Module -Name ActiveDirectory in our PowerShell console on our server should fetch the package from a Content Delivery Network like the PowerShell Gallery and install it on our server or workstation.

However, before installing the AD Module, we must install a pre-requisite package called Remote Server Administration Tools (RSAT).

RSAT enables IT server administrators, to remotely manage roles and features on a Windows Server. These said tools include managing a domain controller with Active Directory Domain Services or AD DS role installed in the server.

We can install this through the GUI method, but for this article, we will be using a PowerShell script to install RSAT on our server.

				
					# import module ServerManager
Import-Module ServerManager

# install RSAT
Install-WindowsFeature -Name "RSAT-AD-PowerShell" -IncludeAllSubFeature

Next, we will be importing the Active Directory Module.

				
					# import ActiveDirectory Module
Import-Module ActiveDirectory

Also Read

Find Disabled Users in OU Using PowerShell Script Tutorial

Finding Inactive Active Directory User Accounts using PowerShell

There are several ways to use PowerShell to get an inactive Active Directory User and this will be covered below.

First, we will be using the method of checking the LastLogonTimeStamp Attribute.

Find inactive users for the past 30 days and export to csv

This checks for Inactive Active Directory users within 30 days and export the result to a CSV:

				
					# set the date (the number of days)
$NumberOfDays = 30

# set the timeframe ranging for the amount of days entered

$TimeRange = (Get-Date).Adddays(-($NumberOfDay))

# checks for inactive users within 30 days timeframe
Get-ADUser -Filter {LastLogonTimeStamp -lt $TimeRange } -Properties * | Select Name, LastLogonDate | Export-Csv InactiveActiveDirectoryUsers.csv -NoTypeInformation

Also Read

Create Office 365 Group Reports with PowerShell Script (Export CSV)

Find inactive users for the past 60 days and export to csv

This checks for Inactive Active Directory users within 60 days and export the result to a CSV:

				
					# set the date (the number of days)
$NumberOfDays = 60

# set the timeframe ranging for the amount of days entered
$TimeRange = (Get-Date).Adddays(-($NumberOfDay))

# checks for inactive users within 60 days timeframe
Get-ADUser -Filter {LastLogonTimeStamp -lt $TimeRange } -Properties * | Select Name, LastLogonDate | Export-Csv InactiveActiveDirectoryUsers.csv -NoTypeInformation

Find inactive users for the past 90 days and export to csv

This checks for Inactive Active Directory users within 90 days and export the result to a CSV:

				
					# set the date (the number of days)
$NumberOfDays = 90

# set the timeframe ranging for the amount of days entered
$TimeRange = (Get-Date).Adddays(-($NumberOfDay))

# checks for inactive users within 90 days timeframe
Get-ADUser -Filter {LastLogonTimeStamp -lt $TimeRange } -Properties * | Select Name, LastLogonDate | Export-Csv InactiveActiveDirectoryUsers.csv -NoTypeInformation

Find inactive users using the Enabled Attribute

Next, this section of PowerShell snippet checks for inactive Active Directory Users by referencing users with the Enabled attribute that have a value of False (boolean):

				
					Get-ADUser -Filter * -Property Enabled | Where-Object {$_.Enabled -like "false"} | Format-Table Name, Enabled -Autosize

Also Read

Create Office 365 User Reports with PowerShell Script (Export CSV)

Find inactive users using the Search-ADAccount

Finally, in the section, we are using a PowerShell cmdlet to search for Active Directory Users, Computers and Service accounts which are inactive.

				
					Search-ADAccount -Accountinactive

Search for only users’ inactive accounts

				
					Search-ADAccount -Accountinactive -Usersonly

Search for only users’ accounts that are inactive within 60days

				
					Search-ADAccount -Accountinactive -TimeSpan 60 -Usersonly

Search for only users’ accounts that are inactive within 60days and export the result to a CSV

				
					Search-ADAccount -Accountinactive -TimeSpan 60 -Usersonly | Select Name, LastLogonDate | Export-Csv InactiveActiveDirectoryUsers.csv -NoTypeInformation

Thank you for reading about how to Find Inactive users in Active Directory using PowerShell Script. Let’s summarize.

Also Read

How to Check Active Directory (AD) Groups Membership using PowerShell