Automatically Disable Inactive Accounts in Active Directory

Automatically disable inactive user or computer accounts in Active Directory using the AD Pro Toolkit built-in schedular. You can define the inactivity time (default 90 days) and choose from a serious of actions to run against the inactive accounts.

Video Demo

If you don’t like videos scroll below to see step by step written instructions.

Conditions

The condition section lets you define how you want to identify inactive users and computers.

• Inactivity time: The account is inactive for at least x days. Default is 90 days, you can change this to any time you need. This uses the lastLogonTimestamp to identify stale accounts.
• Include: Choose to find inactive users, computers or both.
• Path: Select an OU or choose the entire domain
• Exclusions: Add accounts to exclude from being automatically disabled

Actions

This section you configure what actions to run on the inactive accounts.

• Disable: Check this box to auto disable accounts
• Move to OU: Enables moving accounts to another OU
• Description: Adds a description to the account
• Report only: Report only mode sends an email with the identified accounts, but no actions are run.

Create scheduled task

1. Click on “Scheduler” then click “Add”
2. Select “Inactive Accounts” from the dropdown
3. Enter a task name and set the credentials. Click “Next”
4. Set a schedule frequency, daily, weekly or monthly
5. Set the conditions (Path is required)
6. Select one or more actions
7. Choose output options (email or save to csv)
8. Click Save.