Find Inactive Active Directory Accounts

With the Active Directory PowerShell module, user and computer objects that have been unused for a long time can be listed. The query is based on the “LastLogon” timestamp, not the “Disabled” flag.

The query can be used, for example, to identify accounts whose last logon was 90 days ago or longer, in order to disable them afterwards.

PowerShell

Search-ADAccount -UsersOnly -AccountInactive -TimeSpan 90

DsQuery

If PowerShell is not available, the query can also be run with dsquery.exe:

dsquery user -inactive 90

Of course, the accounts found can also be disabled right away with dsmod.exe:

dsquery user -inactive 90 | dsmod user -disabled yes