SERVER-021 · Script
Find Inactive Directory Users
Finds directory user accounts that have not signed in for a set number of days, and can disable and move them.
What it does
An account is inactive when its last sign-in is older than -InactiveDays, or it has never signed in and was created more than -NeverUsedDays ago. Last sign-in comes from lastLogonTimestamp, which domain controllers update roughly every 9 to 14 days, so allow for that in your threshold.
Always skipped: accounts already disabled, the built-in Administrator, Guest and krbtgt accounts, and protected admin accounts (adminCount=1) unless -IncludeProtected is used. Also skipped: members of any -ExcludeGroup, and names matching any -ExcludeName pattern (wildcards allowed).
Report mode (default) lists what would be done. Apply runs -Action:
- Disable: turns the account off and notes the date in its description
- DisableAndMove: also moves it to -DisabledOU
A rollback CSV records each changed account's original OU and description.
Requirements
Windows PowerShell 5.1 and the ActiveDirectory module (RSAT). Rights to disable, edit and move users for Apply.
How to run it
- Run as: a service account with the directory rights the script lists, or SYSTEM on a domain controller or the server being checked
- Run from: a domain-joined management server or admin workstation with the RSAT tools, as a scheduled task or from your management tool
- Script type: PowerShell 5.1, 64-bit
- User interaction: none; the script never prompts
- Timeout: 30 minutes for large directories or many servers
Settings
| Name | What it does | Options | Default |
|---|---|---|---|
| Mode | Report (default) or Apply. | Report, Apply | Report |
| Action | Disable (default) or DisableAndMove. | Disable, DisableAndMove | Disable |
| SearchBase | OU (distinguished name) to check. If empty, the whole domain. | ||
| InactiveDays | Days since last sign-in. Default: 90. | 90 | |
| NeverUsedDays | Days since creation for accounts that never signed in. Default: 30. | 30 | |
| ExcludeGroup | Groups whose members are never touched, for example a "Service Accounts" group. | (none) | |
| ExcludeName | Sign-in name patterns to skip, for example svc-* or scanner*. | (none) | |
| DisabledOU | Destination OU for DisableAndMove. | ||
| IncludeProtected | Also act on protected admin accounts. Off by default. | False | |
| Server | Optional domain controller to use for every call. |
Exit codes
- 0 = No inactive accounts, or all actions done
- 1 = Inactive accounts found in Report mode, or some actions failed
- 2 = Script error (see log)
Testing steps
- Run it first with the mode set to Report on one test OU, test account or test server. Nothing is changed in that mode.
- Read the log and confirm the planned changes are what you expect.
- Run your chosen settings on the same test target and confirm the result.
- Check the exit code: 0 = OK, 1 = needs attention, 2 = error (see log), 9 = this copy is past its Valid until date.
- Roll out to a small group next, then everyone.
Rollback steps
Report mode changes nothing. Apply saves a rollback CSV with each account's original OU and description. To undo, enable the account, move it back and restore the description from that file.
Version and change log
| Version | Date | Changes |
|---|---|---|
| 1.0.0 | November 2026 | First release. |