That sure is a long title for a blog post. Anyhow, I seem to hear the following question a lot: “In Active Directory, how do I figure out which account objects are valid?” Well, first off, if you don’t have a really good process in place for managing accounts within your directory. Then I suggest that you try to get a better handle on managing these objects. I can’t tell you how many environments I’ve seen where any of the following statements are true:
- Gee, there is this service account that no one knows about, we think it may be critical for our HR application, but we really don’t have a clue.
- Bob Johnson was fired several months ago, how come his account is still active?
- We have 1,000 employees, but over 10,000 user account objects in our directory.
So… stepping off of my soap box… let me explain how one might figure out if account objects are valid within their directory by referencing the following attributes:
- lastLogon
- lastLogonTimeStamp
- pwdLastSet
All three of these attributes would contain a large integer value that represents the number of 100 nanosecond intervals since January 1, 1601 (UTC). Translated the value represent either when the account last logged onto the domain or had its password changed.
The pwdLastSet attribute is a replicated attribute that contains the last time an account’s password was changed. For machine accounts this is key because the default behavior of a domain member is to change its password every 30 days. This means that you can write a script which performs a search for all machine objects that have passwords older than 90 days. In theory, the resulting object collection either has machines that are invalid, or having issues talking to the domain.
For user objects you would want to look at the lastLogon and the lastLogonTimeStamp attributes. Both attributes, contain the last time an account has logged into the domain. However, the lastLogon attribute is a non-replicated attribute. So, if you want to use this attribute, all domain controllers would need to queried and some type of convergence performed. The lastLogonTimeStamp attribute is a replicated attribute, but your domain must be at Windows Server 2003 functional level or greater and its value is only updated if the old value is more than 14 days in the past. Thus, you can also write a script which performs a search for all user objects that have not logged onto the domain in 30 days. Thus, in theory, the resulting object collection would contain user accounts that are invalid.
