list of inactive users

[techie211]

hey ppl, I'm trying to create a query to get a list of users inactive for 60 days or users who have not logged on to the network for 60 days. I tried to run dsquery but got an "dsquery failed: the parameter is incorrect. Windows could not run this query because you are connected to a domain that does not support this query". Any help on this is appreciated

[pete]

What's the functional level of your domain/forest? That might be where dsquery is choking.

 

dsquery -inactive 8

 

will give you a list of people who haven't logged in for 8 weeks (56 days)

 

Use the -o option to format the output (samid for example) and the -limit option to set how many to display.

 

dsquery user /? for usage.

 

It's also (iirc) a pre-canned GUI query from AD Users and Computers.

Edited April 26, 2011 by pete

[techie211]

functional level of your domain = Windows 2000 native

[sukh]

You would want to filter out any resource/service accounts as these wil be inactive but used.

[glennda]

I think you can do an advanced search in AD for people who have not logged in for a set period. I then tend to select all remove to a new ou and then wait a few months and then finally delete the accounts.

[pete]

functional level of your domain = Windows 2000 native

 

That'll be why - dsquery relies on lastLogonTimeStamp, which needs 2003 native or greater.

[techie211]

What is my next option as I can't switch domain function levels yet?

[glennda]

What is my next option as I can't switch domain function levels yet?

 

In Ad open up search - select the Find: drop down menu and select Common Queries. You can then select select days since last logon.

[joe90bass]

In Ad open up search - select the Find: drop down menu and select Common Queries. You can then select select days since last logon.

 

I've run dsquery before to disable inactive accounts, but shockingly I didn't know you could do this! So easy, so obvious...... And I see I can do what I wanted to check out - see who has non-expiring passwords!

[glennda]

I've run dsquery before to disable inactive accounts, but shockingly I didn't know you could do this! So easy, so obvious...... And I see I can do what I wanted to check out - see who has non-expiring passwords!

 

it took me a lot of googling to find that!

[techie211]

In Ad open up search - select the Find: drop down menu and select Common Queries. You can then select select days since last logon.

 

I'm at that section but I get nothing in results..?? what do I put in the 'Name' and 'Description' box? thanks

[glennda]

I'm at that section but I get nothing in results..?? what do I put in the 'Name' and 'Description' box? thanks

 

nothing - just make sure you are search whole domain.

[techie211]

when I search for just 'Disabled accounts' I get results but once I select a 'Days since last logon' the results window is blank..?? could it be my domain function level again?

[glennda]

when I search for just 'Disabled accounts' I get results but once I select a 'Days since last logon' the results window is blank..?? could it be my domain function level again?

 

not to sure - have you tried the smallest amount of days?

[techie211]

yes, tried them all

[glennda]

yes, tried them all

 

not a clue then - it might be to do with function level but i have no experience of server 2k

[sukh]

@techine - Domain Func should not make any diff.

 

Are you sure you're not selecting both disabled and days since last login...

[techie211]

@techine - Domain Func should not make any diff.

 

Are you sure you're not selecting both disabled and days since last login...

 

yes, our network is all Win2k3 except for two servers which are DC's or I would raise the level to Windows Server 2003

[sukh]

dont select disable and then try to search using days since last login, try 30 and see what results you get.

 

no need to raise func