Get a list of users in Active Directory who have not logged in for specified number of days using PowerShell

July 18, 2017

Get a list of users in Active Directory who have not logged in for specified number of days using PowerShell

Active Directory, Office 365, PowerShell

A client is currently in the planning stages of doing a migration to Azure AD and Office 365 and one of the things we needed was a list of users who have not logged on in the last few months but are still active in our AD.

Well it’s PowerShell to the rescue again (with Visual Studio Code my IDE of choice) with the following snippet of code which will query an AD environment looking for accounts which haven’t been touched in this case for 90 days and give me a nice CSV of their name and last logon timestamp.

import-module ActiveDirectory 
$domain = "adatum.com.au" 
$DaysInactive = 90
$time = (Get-Date).Adddays(-($DaysInactive))
 
# Get AD Users with lastLogonTimestamp less than time specified and is enabled
Get-ADUser -Filter {LastLogonTimeStamp -lt $time -and enabled -eq $true} -Properties LastLogonTimeStamp |
 
# Output Name and lastLogonTimestamp attributes into CSV
select-object Name,@{Name="Stamp"; Expression={[DateTime]::FromFileTime($_.lastLogonTimestamp).ToString('yyyy-MM-dd')}} | export-csv Inactive_Users.csv -notypeinformation

Save the above into a PS1 and then run this on a server which has the AD PowerShell modules (usually one of your DCs) and will then create a CSV located where the script is with a list of all the users who are still enabled but haven’t logged on in your environment.

7 responses to “Get a list of users in Active Directory who have not logged in for specified number of days using PowerShell”

Jose

May 5, 2018

Great ! Thanks a lot!
I’ve found some others scripts but this one works like a charm.

Reply
Farouk

June 13, 2019

Thanks! Great job.

Do you know how to disable these account that are not used since 90 days?

Thanks a lot!

Reply
1. John
  
  June 22, 2019
  
  Hey Farouk, something like the below should do what you’re after (not using the Quest AD module)…
  
  Get-ADUser -Properties name,lastLogonDate,mail -Filter * | Where { $_.lastLogonDate -lt (get-date).addmonths(-3) }
  
  Reply
  1. FAROUK
    
    July 3, 2019
    
    Hey John, Thanks for your reply, this command can show me wich users are unused since 90 days but this don’t disable them right?
    
    I want to disable them by using something like this, but it show me an error with Identity parameter
    
    $user = Import-csv -path “C:\X\Disabled_Accounts.csv”
    
    forEach ($user in $users) {
    Disable-ADAccount -Identity $($user.samaccountname)
    }
    
    Regards
    
    Farouk
    
    Reply
Sahul Meeran

October 10, 2019

Hi, Thanks for great share. Can you share me how to get the OU wise not for all domain wise.
Can u guide on this

Reply
1. Joe L
  
  June 3, 2020
  
  Hi Sahul-
  You can add the -searchBase option:
  Get-ADUser -Properties name,lastLogonDate -Filter * -searchBase ‘OU=users,OU=enterprise,dc=thisDomain,dc=com’ | Where { $_.lastLogonDate -lt (get-date).adddays(-90) }
  
  Reply
Fred Davisson

July 30, 2021

If I wanted to sort the date on that export file by the oldest date at the top and the newest at the bottom, where would i place that sort command?

Reply

Assigning resources via logon script based on computer names.

We’ve recently been having an issue where printers being deployed via group policy haven’t been deploying, or are deploying but not being set to default. So after some investigation, the easiest thing to do would be to write a Visual basic script to ease the deployment of printers throughout our environment. Luckily for us we […]

CrowdStrike Next-Gen SIEM and FortiGate Connector

So I’m working on getting all of our external systems connected into the CrowdStrike Next-Gen SIEM as part of our internal Falcon Complete tenancy. Following the documentation in the CrowdStrike portal, getting and installing the Log Collector and setting up the connector were a pretty straightforward affair. I’ve got a Windows VM setup as a […]

Certificate Chain Error when updating Certificates in Aruba ClearPass

I was recently contacted by someone to assist with some maintenance on their Aruba ClearPass Policy Manager servers. One of those tasks was replacing their expiring, but everytime they went to replace it they got an error along the lines of Certificate chain is invalid. The expected order is Policy Manager Server, Sub CA and […]

A Windows System Admin's Blog