Best way to remove old accounts from AD

Question

Hi,

We have over 6000 account which are disabled and enabled but not login more then 6 months.

How do I identify which account are in use and which accounts are not in use.

Does anyone has an script which they use to clear old account from AD

Answer 1

Hello lalajee,

Take a look at the following article:

Regularly check for and remove inactive user accounts in Active Directory

https://learn.microsoft.com/en-us/services-hub/health/remediation-steps-ad/regularly-check-for-and-remove-inactive-user-accounts-in-active-directory

$d = [DateTime]::Today.AddDays(-180)
Get-ADUser -Filter '(PasswordLastSet -lt $d) -or (LastLogonTimestamp -lt $d)' -Properties PasswordLastSet,LastLogonTimestamp | ft Name,PasswordLastSet,@{N="LastLogonTimestamp";E={[datetime]::FromFileTime($_.LastLogonTimestamp)}}

Hope this helps.

---

If this is helpful please accept answer.