Finding Stale Accounts in Active Directory

 Executive Summary:

StaleAccounts.js, a new tool written in JScript, makes finding stale accounts in Active Directory (AD) easy. It searches using the lastLogon, lastLogonTimestamp, or pwdLastSet attributes, and it can look for either user or computer objects.

Have you ever wished you had a list of every stale account in a domain? Such a list would help you deal more efficiently with accounts that haven’t seen activity lately—either the password hasn’t been changed in a while or it hasn’t been used to log on recently. The LastLogon.js script that I presented in "Finding a User's Last Logon" (July 2007, InstantDoc ID 96302), lists an account's last logon date and logon server. Although LastLogon.js is useful, I wanted a more specific tool that could find stale accounts. So I wrote StaleAccounts.js. It searches Active Directory (AD) for stale accounts based on the number of days of inactivity that you specify on the command line. It uses the lastLogon, lastLogonTimestamp, or pwdLastSet attribute for searching, and it can search for either user or computer objects. . . .