How can I get a list of accounts that haven’t logged on in the last 30 days? We’re concerned that we might not have disabled the accounts of employees and contractors who aren’t with our company any longer.
Active Directory (AD) user accounts have a last logon date and time property, and Windows domain controllers (DCs) update the last logon date and time. Windows 2000 Server DCs don’t replicate this property to other DCs, so if you’re running Win2K, whatever means you use to query this field must query each DC and select the most recent date and time. In a domain that has been upgraded to Windows Server 2003 functionality and has Windows 2003 DCs, you can query any DC because Windows 2003 replicates the field.
I recommend the free DumpSec tool (available at http://www.system tools.com) if you need to query Win2K DCs because the DumpSec users report includes a last logon column and can determine the most recent logon date from all the DCs. When you run the users report, DumpSec displays a dialog box that lets you select what’s included in the report. Make sure you select the Show true last logon check box, which tells DumpSec to query every DC for the most recent logon for each user.
The Windows 2003 Microsoft Management Console (MMC) Active Directory Users and Computers snap-in provides access to the last logon field through the native Windows interface. Open the snap-in, right-click Saved Queries, and select New, New Query. In the New Query dialog box, enter a name such as Old accounts and click Define Query. In the Find dialog box, make sure Common Queries is selected in the Find drop-down list. Then enter 30 in the Days since last logon field and click OK twice to close the dialog boxes.
Windows will now search the domain and display a list of all the user accounts that haven’t logged on in the past 30 days. The only problem with this method is that Windows doesn’t let you filter out disabled accounts, so you’ll see disabled accounts in addition to dormant accounts that you might still need to disable. If this is a problem, I recommend sticking with DumpSec, even for Windows 2003.