Inactive user and computer accounts of Active Directory open gates for hackers and can cause serious security issue for you. Such inactive accounts might be belong to users who have left the organization, or users who log-on in their accounts very rarely or users who have moved to some other positions and such accounts are no longer useful from them. Regular checkup of AD to detect inactive accounts can help you and you can manage such accounts by disabling, deleting, moving them to other OU or by resetting password.
Inactive user and computer accounts in AD can detect by following dsquery commands
For Users:
dsquery user -inactive <NumWeeks>
If you want to find out the users who have not logged in their accounts from past 12 weeks then use above query as dsquery user -inactive 12
For Computers:
dsquery computer -inactive <NumWeeks>
If you want to find out the computers who have been idle from past 12 weeks then use above query as dsquery computer -inactive 12
Identifying and managing inactive account is really a very time consuming and tiring task. You can also use and automated software for Active Directory Cleanup

