Daily Scheduled Task to Disable Inactive Users

Question

Hello,

I'm trying to create a daily scheduled task that runs that automatically disables users AD accounts who havent logged in to the domain in 45 days. At the same time, I want to send out emails to those users 7 days and 24 hours prior to their accounts being disabled in order to give them a chance to log in and reset the 45 day timer.

Thus far I've come up with a scheduled task that looks like the following. Is this the best way to handle this use-case?

I'd appreciate any guidance around best-practices or ways I can make this task more resilient. For instance, how could i make sure that I catch all accounts that have last logon dates earlier than the 45 day cutoff?

I noticed that Adaxes already provides a built-in condition that checks the users inactivity period but it appears to only allow me to select weeks instead of days.

Answer 1

Hello,

As long as you need to check user logins, it is recommended to validate both the Last Logon and Last-Logon-Timestamp properties. The thing is that the Last Logon property is not replicated and thus contains different values on domain controllers. At the same time, Last-Logon-Timestamp is replicated but can still contain a value which is in the past comparing to that of the Last Logon property. To check whether the dates in the properties match a specific date in the past, the equality comparison of the If <property> <relation> <value> condition cannot be used as it takes into account the time part of the values compared (up to seconds) which will probably never be met. To achieve the desired, you need to use the below script in the If PowerShell script returns true condition. In the script, the $days variable specifies the number of days to be added to the current date for comparison. To deduct days, specify the number with a leading minus character (e.g. -45).

$days = -14 # TODO: modify me

# Get Last Logon date
try
{
    $lastLogonValue = $Context.TargetObject.Get("lastLogon")
    $lastLogonTime = [DateTime]::FromFiletimeUtc([Int64]::Parse($lastLogonValue))
}
catch
{
    $lastLogonTime = [DateTime]::MinValue
}

$lastLogonDate = $lastLogonTime.Date

# Get Last Logon Timestamp date
try
{
    $lastLogonTimestampValue = $Context.TargetObject.Get("lastLogonTimestamp")
    $lastLogonTimestampTime = [DateTime]::FromFiletimeUtc([Int64]::Parse($lastLogonTimestampValue))
}
catch
{
    $lastLogonTimestampTime = [DateTime]::MinValue
}

$lastLogonTimestampDate = $lastLogonTimestampTime.Date

# Compare dates
$compareDate = (([System.DateTime]::UtcNow).AddDays($days)).Date
$Context.ConditionIsMet = ($lastLogonTimestampDate -eq $compareDate) -or ($lastLogonDate -eq $compareDate)

Finally, your Scheduled Task will look like the following: In each of the script conditions, the $days variable will have a corresponding value (e.g. -38, -44 and -45).

Comments

Thank you! This script appears to be working now.

One final question. How could i modify the final condition to ensure that all accounts with login dates of 45 days OR BEFORE are also disabled?

---

Hello,

It can be done by updating the comparison parameters in the script. Here is the exact script you will need to use in the last condition.

$days = -45 # TODO: modify me

# Get Last Logon date
try
{
    $lastLogonValue = $Context.TargetObject.Get("lastLogon")
    $lastLogonTime = [DateTime]::FromFiletimeUtc([Int64]::Parse($lastLogonValue))
}
catch
{
    $lastLogonTime = [DateTime]::MinValue
}

$lastLogonDate = $lastLogonTime.Date

# Get Last Logon Timestamp date
try
{
    $lastLogonTimestampValue = $Context.TargetObject.Get("lastLogonTimestamp")
    $lastLogonTimestampTime = [DateTime]::FromFiletimeUtc([Int64]::Parse($lastLogonTimestampValue))
}
catch
{
    $lastLogonTimestampTime = [DateTime]::MinValue
}

$lastLogonTimestampDate = $lastLogonTimestampTime.Date

# Compare dates
$compareDate = (([System.DateTime]::UtcNow).AddDays($days)).Date
$Context.ConditionIsMet = ($lastLogonTimestampDate -le $compareDate) -or ($lastLogonDate -le $compareDate)

---

Works perfectly. Thank you!

---

Hello - we are testing this script and are finding that it is sending new users an email because the LastLogon or LastLogonTimeStamp is still set to "<not set>". How can this script be modified to omit those users?

---

Hello,

Try using this version of the script:

$days = -45 # TODO: modify me

# Get Last Logon date
try
{
    $lastLogonValue = $Context.TargetObject.Get("lastLogon")
    $lastLogonTime = [DateTime]::FromFiletimeUtc([Int64]::Parse($lastLogonValue))
}
catch
{
    $lastLogonTime = [DateTime]::MinValue
}

$lastLogonDate = $lastLogonTime.Date

# Get Last Logon Timestamp date
try
{
    $lastLogonTimestampValue = $Context.TargetObject.Get("lastLogonTimestamp")
    $lastLogonTimestampTime = [DateTime]::FromFiletimeUtc([Int64]::Parse($lastLogonTimestampValue))
}
catch
{
    $Context.ConditionIsMet = $False
    return
}

$lastLogonTimestampDate = $lastLogonTimestampTime.Date

# Compare dates
$compareDate = (([System.DateTime]::UtcNow).AddDays($days)).Date
$Context.ConditionIsMet = ($lastLogonTimestampDate -le $compareDate) -or ($lastLogonDate -le $compareDate)

---

thank you. it appears this is working as expected.

---

Hi,

Sorry to revive this I know its a couple of years old, Tried using this and for the most part works as expected. However we have an issue where Last Logon is Unspecified, because of this it is disabling accounts that have a last login timestamp of even yesterday. Is there a way to make this return false if Last Logon is Unspecified?

Regards

---

Hello Wayne,

Do we understand correctly that you need the condition to be met when the Last Logon or Last Logon TimeStamp equals the current date minus a certain number of days? If that is correct, no script might be required. In Adaxes version 2021.1 it can be done using built-in conditions. For example: For information on how to check the Adaxes version you are using, see https://www.adaxes.com/help/CheckServiceVersion.

---

Hi,

I will try and set this out a bit clearer as I did not do so properly before.

We have the need to disable inactive accounts after a 60 day period. And also a need to disable accounts that have never logged in after a 60 day period.

We had noticed that even if an account was already disabled the script would still run against them and we dont want that as the email we generate then creates a Jira ticket for User Services to then fully deprovission the account.

o what we have is this:

We then ran the above for the 1st time this morning and it disabled 29 accounts, some of which was perfectly fine. But other accounts had Last Logon - Unspecified and Last Login Timestap as a recent date like below:

The accounts like this also got disabled, I believe the Unspecified is due to DC replication.

Maybe I am over thinking it and doing it as per the last responce is a better and easier way of achiving our requirements.

Regards

---

Hello Wayne,

Thank you for clarifying. In your case, the first condition will not be met in most cases even for disabled accounts as it requires the Account Options property to have only a single flag enabled. As you only need to check user inactivity and account status, the scheduled task will look like the following:

---

Thank you