A large organisation usually comprises thousands of user accounts and computers. There can be users who don’t logon to the Active Directory directly instead, they logon indirectly through Exchange, Outlook Web Access, Remote Access, VoIP or another service-based account.
In addition, there can be a vast range of users with temporary accounts that would be expired after a specific period. Similarly, an organisation will also have temporary computers that were used for only few minutes or hours in the past. Such unused user and/or computer accounts still exist in the Active Directory even when they are not in use presently and will not be used in the future as well. These obsolete user/computer accounts can be a great threat to an organisation.
The regulatory compliances have made it a mandate to keep an eye on the inactive user and computer accounts and to manage them in order to avoid security hazards. No well-timed action on the user accounts, which are inactive for more than 90 days, will definitely result in security loss and disobedience of the mandatory compliances, which in turn will attract fine.
Let us have a look at the commands to list the inactive user and computer accounts, which are not being used for the last specific days.
Listing Inactive Users
Run the following command at Windows PowerShell. This would list the inactive users with enabled accounts after a specific duration. Here, the time duration is specified using TimeSpan attribute that contains values in the format D.H:M:S:F i.e.
Day.Hours:Month:Seconds:Fractions of Second
Search-ADAccount -AccountInactive -TimeSpan 90.00:00:00 | ?{$_.enabled -eq $true} | %{Get-ADUser $_.ObjectGuid} | select name, givenname, surname
You can redirect this list to create a CSV file by suffixing the export-csv CMDlet or its epcsv alias.
Search-ADAccount -AccountInactive -TimeSpan 1.00:00:00 | ?{$_.enabled -eq $true} | %{Get-ADUser $_.ObjectGuid} | select name, givenname, surname | epcsv C:\unusedenableduseraccounts.csv
Listing the Inactive Computer Accounts
Run the following command to list the inactive computers.
dsquery computer -inactive <number of days> -limit 0
What should be done with inactive accounts?
From the security and compliance point of view, the inactive user and computer accounts should be disabled or removed from the Active Directory. The administrator can also move such unused accounts to an Organisational Unit. This not only will secure an organisation from the unidentified security threats, but also saves it from attracting a fine by ignoring the abidance to the compliance.
It’s very complicated first to list down the number of inactive user and computer after a specific duration and then to disable/remove them using native tools. This complexity level reaches top when it comes to automate the identification and management of unused user accounts in different domains.
Ranging from security experts to the compliance, everyone suggests to find out the inactive user and computer accounts which act as the loopholes in the security of an organisation. These loopholes should be covered means the inactive account should be deleted or disabled before it’s too late.
Satyendra Kumar is marketing, PR and software quality assurance manager at Lepide Software
