Inactive user task not working as expected

Question

We have an inactive user task which runs daily that disables accounts after 30 days of inactivity.

We had an example yesterday of a user account which had been disabled which had a last-logon-timestamp attribute value of 17/08/17. The last-logon attribute was displayed in the addaxes console as 14/07/17.

As we believed the addaxes inactive user task uses the last-logon-timestamp attribute to determine the period of inactivity we cannot work out why this happened.

We have checked the replication of the last-logon-timestamp attribute across all our DC's and it is consistent.

Are you able to provide any explanation of how this could have happened?

Regards
Andy

Comments

Hello Andy,

Could you check the value of the Last-logon-Timestamp property for the user in Adaxes? Is it also 17/08/17?
Pay attention that Last Logon and Last-Logon-Timestamp are absolutely different properties in AD.

---

Yes it was. I also checked the value on all of the DC's to ensure we did not have one which was not replicating that field correctly as I believed this was the attribute used to determine inactivity.

---

What are the other criteria that the Adaxes system uses to determine inactivity or is it simply that attribute?

---

Hello Andy,

Adaxes determines user inactivity based on the Last-Logon-Timestamp (LDAP display name lastLogonTimestamp) and Password Last Set (pwdLastSet) attributes, whichever is most recent.

Can you make sure that the user was disabled by your task? To do this, you can check the Management History of the user account. To access it, right-click the user and select All Tasks \ Management History.

For troubleshooting purposes, can you post here or send us to support[at]adaxes.com a screenshot of the actions and conditions of the Scheduled Task? Also, can you do the following:

1. Create a new Custom Command.

2. On step 2 of the Create Custom Command Wizard, select User.
   

3. On step 3, add the Run a program or PowerShell script action and paste the following script line:

    $Context.LogMessage("%adm-InactivityDuration%", "Information")
   

   

4. Enter a short description and click OK.

5. Click Next, then click Finish.

6. Execute the Custom Command on the user in question. The number of days a user has been inactive per Adaxes calculations will be displayed in the Execution Log. How many days do you get?