How can I get a list of accounts
that haven’t logged on in the last 30
days? We’re concerned that we might
not have disabled the accounts of
employees and contractors who
aren’t with our company any longer.
Active Directory (AD) user
accounts have a last logon date and
time property, and Windows domain
controllers (DCs) update the last
logon date and time. Windows 2000
Server DCs don’t replicate this property to other DCs, so if you’re running
Win2K, whatever means you use to
query this field must query each DC
and select the most recent date and
time. In a domain that has been
upgraded to Windows Server 2003
functionality and has Windows 2003
DCs, you can query any DC because
Windows 2003 replicates the field.
I recommend the free DumpSec
tool (available at http://www.system
tools.com) if you need to query
Win2K DCs because the DumpSec
users report includes a last logon column and can determine the most
recent logon date from all the DCs.
When you run the users report,
DumpSec displays a dialog box that
lets you select what’s included in the
report. Make sure you select the
Show true last logon check box,
which tells DumpSec to query every
DC for the most recent logon for each
user.
The Windows 2003 Microsoft
Management Console (MMC) Active
Directory Users and Computers snap-in provides access to the last logon
field through the native Windows
interface. Open the snap-in, right-click Saved Queries, and select New,
New Query. In the New Query dialog
box, enter a name such as Old
accounts and click Define Query. In
the Find dialog box, make sure Common Queries is selected in the Find drop-down list. Then enter 30 in the
Days since last logon field and click
OK twice to close the dialog boxes.
Windows will now search the
domain and display a list of all the
user accounts that haven’t logged on
in the past 30 days. The only problem
with this method is that Windows
doesn’t let you filter out disabled
accounts, so you’ll see disabled
accounts in addition to dormant
accounts that you might still need to
disable. If this is a problem, I recommend sticking with DumpSec, even
for Windows 2003.