constantly entering new users in the organization, and others are killed. If procedures are done well, who runs the Active Directory have access to that information in a timely manner, allowing users to disable accounts that are no longer used.
The reality is that there are many cases where this does not happen, and many user accounts are enabled but have not been using for some time. The causes may be:
a) Human Resources warns no resignations or dismissals.
b) Users are absent for long periods (vacation leave, work accidents, maternity).
c) Service accounts are not used more.
There is a simple way to see which accounts have not been using for some time.
dsquery user-inactive 2-limit 0
Running this command, we can see what activity users have registered the last two weeks, the limit indicates the number of results you want to see, where zero means "no limit".
can execute this command using pipes to combine with others and take action. Or send it to a text file with>
To pass information to a text file: dsquery user-inactive
2-limit 0> c: \\ Users \\ edeleo \\ Desktop \\ Users.txt
To Move inactive users to another OU :
dsquery user-inactive 2-limit 0 dsmove-newparent "OU = To delete, DC = Labemd, DC = NET"
To disable inactive users:
dsquery user-inactive 2-limit 0 dsmod user-disabled yes
users to delete certain OU:
dsquery user "OU = To delete, DC = Labemd, DC = NET" dsrm
The combinations are many and are not limited to these examples. It is also useful to use "dsquery computer" to find equipment inactive people who did not change their password or have disabled accounts, as shown in the example: dsquery computer-
disabled
In another article of this blog shows how to find disabled PCs, using "Active Directory User and Computers ". The advantage of using command line tools instead of graphical interface is the ability to automate the task. In this way we create a task for every Friday at 18:30 in where to move OU teams, users are disabled or anything else we need.
To learn more ...
Dsquery in Techenet
The reality is that there are many cases where this does not happen, and many user accounts are enabled but have not been using for some time. The causes may be:
a) Human Resources warns no resignations or dismissals.
b) Users are absent for long periods (vacation leave, work accidents, maternity).
c) Service accounts are not used more.
There is a simple way to see which accounts have not been using for some time.
dsquery user-inactive 2-limit 0
Running this command, we can see what activity users have registered the last two weeks, the limit indicates the number of results you want to see, where zero means "no limit".
can execute this command using pipes to combine with others and take action. Or send it to a text file with>
To pass information to a text file: dsquery user-inactive
2-limit 0> c: \\ Users \\ edeleo \\ Desktop \\ Users.txt
To Move inactive users to another OU :
dsquery user-inactive 2-limit 0 dsmove-newparent "OU = To delete, DC = Labemd, DC = NET"
To disable inactive users:
dsquery user-inactive 2-limit 0 dsmod user-disabled yes
users to delete certain OU:
dsquery user "OU = To delete, DC = Labemd, DC = NET" dsrm
The combinations are many and are not limited to these examples. It is also useful to use "dsquery computer" to find equipment inactive people who did not change their password or have disabled accounts, as shown in the example: dsquery computer-
disabled
In another article of this blog shows how to find disabled PCs, using "Active Directory User and Computers ". The advantage of using command line tools instead of graphical interface is the ability to automate the task. In this way we create a task for every Friday at 18:30 in where to move OU teams, users are disabled or anything else we need.
To learn more ...
Dsquery in Techenet
