Definition of an Inactive User

Question

Hello,

We're trying to automate disabling inactive users and I have a question about the built in scheduled task discussed here:

http://www.adaxes.com/tutorials_Automat ... yUsers.htm

The Task checks to see if a user is inactive for more than 12 Weeks.

Where does it get the starting date of the 12 weeks from? Creation date of the user account or the user's last logon?

Answer 1

Hello Drew,

Adaxes determines inactive user accounts based on the Last-Logon-Timestamp (LDAP name lastLogonTimestamp) and the When Created (LDAP name whenCreated) attributes. Inactive accounts are users who:

• were created more than the specified number of days ago;
• have not logged in to Active Directory during the specified number of days.

Comments

Hi

I came across this article, that states that LastLogonTimeStamp may not be the best way to identify an inactive user -

https://blogs.technet.microsoft.com/ask ... -s4u2self/

We can confirm that LastLogonTimeStamp is updated in our AD, dispite that the user account is disabled or expired.

- Thanks

---

Hello,

Thank you for sharing the information.

It is a well-known side effect, that the Last Logon Timestamp property value is updated for a user when you check Effective permissions of the user in Active Directory Users and Computers. Unfortunately, there is no workaround for this behavior.