Skip to content

How to indentify inactive user and computer accounts in Active Directroy

Inactive user and computer accounts of Active Directory open gates for hackers and can cause serious security issue for you. Such inactive accounts might be belong to users who have left the organization, or users who log-on in their accounts very rarely or users who have moved to some other positions and such accounts are no longer useful from them. Regular checkup of AD to detect inactive accounts can help you and you can manage such accounts by disabling, deleting, moving them to other OU or by resetting password.

Inactive user and computer accounts in AD can detect by following dsquery commands

For Users:

ManageEngine Applications Manager

dsquery user -inactive <NumWeeks>

If you want to find out the users who have not logged in their accounts from past 12 weeks then use above query as dsquery user -inactive 12

For Computers:

dsquery computer -inactive <NumWeeks> 

active directory auditing solutions

If you want to find out the computers who have been idle from past 12 weeks then use above query as dsquery computer -inactive 12

Identifying and managing inactive account is really a very time consuming and tiring task. You can also use and automated software for Active Directory Cleanup