4

I would like to find all unused accounts of the active directory, so I need to see the last access to the domain. I looked into the user properties but I did not find anything. Where can I find this information?

Bart De Vos
  • 17,911
  • 6
  • 63
  • 82
Tobia
  • 1,272
  • 9
  • 41
  • 81

2 Answers2

5

Open up your AD Users & Computers. Go to Saved Queries. Rightclick > New > Query. Give it an easy to remember name. Click on Define Query. Find > Custom Search > Advanced.

Paste this into the box:

(&(objectCategory=person)(objectClass=user)(lastLogonTimeStamp<=128147796000000000))

Press OK twice. Voila, you now have the accounts that have not logged on since Feb. 1, 2007.

enter image description here

If you want to change the date, change the number in the qry above. You can use this tool for the conversion. Alternative here

Bart De Vos
  • 17,911
  • 6
  • 63
  • 82
  • It is needed the Win 2003 domain level, before 2003 compatibility this doesn't work. – Tobia Jul 17 '12 at 08:06
  • This works in all domains with a functional level 2003 or higher. If you are running anything below 2003 FL, you should consider upgrading ASAP. – Bart De Vos Jul 17 '12 at 08:08
  • I know i should, but I have to get informations about this upgrade to understand what it will change. – Tobia Jul 17 '12 at 08:12
  • @Tobia: You can use ADSI edit to check manually, or write your own LDAP script to get the information from an earlier domain FL. The attribute is called lastLogonTimeStamp ... and good luck with that. Might wanna elevate the domain first, then worry about querying AD attributes. – HopelessN00b Jul 17 '12 at 18:50
0

Try the built-in tools like Active Directory Users, and check for additional columns on your Domain Controller.

Also you can connect to your domain controller with LDAP Administrator or similar tool, so you can see perfectly all the smallest details of the LDAP DB, but some is binary data, so to change anything it's really much better to use Windows Domain Controller tools.

Andrew Smith
  • 1,143
  • 13
  • 23