list of inactive users

[techie211]

hey ppl, I'm trying to create a query to get a list of users inactive for 60 days or users who have not logged on to the network for 60 days. I tried to run dsquery but got an "dsquery failed: the parameter is incorrect. Windows could not run this query because you are connected to a domain that does not support this query". Any help on this is appreciated

[pete]

What's the functional level of your domain/forest? That might be where dsquery is choking.

dsquery -inactive 8

will give you a list of people who haven't logged in for 8 weeks (56 days)

Use the -o option to format the output (samid for example) and the -limit option to set how many to display.

dsquery user /? for usage.

It's also (iirc) a pre-canned GUI query from AD Users and Computers.

[techie211]

functional level of your domain = Windows 2000 native

[sukh]

You would want to filter out any resource/service accounts as these wil be inactive but used.

[glennda]

I think you can do an advanced search in AD for people who have not logged in for a set period. I then tend to select all remove to a new ou and then wait a few months and then finally delete the accounts.

[pete]

functional level of your domain = Windows 2000 native

That'll be why - dsquery relies on lastLogonTimeStamp, which needs 2003 native or greater.

[techie211]

What is my next option as I can't switch domain function levels yet?

[glennda]

What is my next option as I can't switch domain function levels yet?

In Ad open up search - select the Find: drop down menu and select Common Queries. You can then select select days since last logon.

[joe90bass]

In Ad open up search - select the Find: drop down menu and select Common Queries. You can then select select days since last logon.

I've run dsquery before to disable inactive accounts, but shockingly I didn't know you could do this! So easy, so obvious...... And I see I can do what I wanted to check out - see who has non-expiring passwords!

[glennda]

I've run dsquery before to disable inactive accounts, but shockingly I didn't know you could do this! So easy, so obvious...... And I see I can do what I wanted to check out - see who has non-expiring passwords!

it took me a lot of googling to find that!

[techie211]

In Ad open up search - select the Find: drop down menu and select Common Queries. You can then select select days since last logon.

I'm at that section but I get nothing in results..?? what do I put in the 'Name' and 'Description' box? thanks

[glennda]

I'm at that section but I get nothing in results..?? what do I put in the 'Name' and 'Description' box? thanks

nothing - just make sure you are search whole domain.

[techie211]

when I search for just 'Disabled accounts' I get results but once I select a 'Days since last logon' the results window is blank..?? could it be my domain function level again?

[glennda]

when I search for just 'Disabled accounts' I get results but once I select a 'Days since last logon' the results window is blank..?? could it be my domain function level again?

not to sure - have you tried the smallest amount of days?

[techie211]

yes, tried them all