PowerShell Get AD User Not Logged in X Days

Very often as an Administrator, we want to get ad user not logged in for specific days. This will helps to find inactive user accounts in active directory.

PowerShell Get-ADUser cmdlet gets one or more specific users in active directory. Using Get-ADUser Filter parameter to get specific users account based on search criteria.

In this article, I will explain how to get ad user not logged in 90 days or specific days using PowerShell.

Get AD user not logged in last 30 days

If you want to get ad user not logged in last 30 days and export to csv file , use Get-ADUser filter parameter to specify condition as below

$InactiveDays = 30
$Days = (Get-Date).Adddays(-($InactiveDays))

Get-ADUser -Filter {LastLogonTimeStamp -lt $Days -and enabled -eq $true} -Properties LastLogonTimeStamp |
select-object Name,@{Name="Date"; Expression={[DateTime]::FromFileTime($_.lastLogonTimestamp).ToString('MM-dd-yyyy')}} | export-csv C:\LastLogOn_Users.csv -notypeinformation

In the above PowerShell script,

$InactiveDays – variable contains 30

$Days – variable contains inactive days, in our example it 30 days

Using PowerShell Get-ADUser filter parameter, it compares ad user lastlogonTimestamp property less than specified days and user status is enabled in active directory.

It then pass ad user objects to second command to select Name, LastLogonDate of users and export users not logged in last 30 days to csv file using Export-Csv cmdlet.

Cool Tip: How to find disabled aduser in OU in PowerShell!

Find Inactive User Accounts in Active Directory

If you want to find inactive user accounts in active directory who has not logged in last 90 days or specific days, run below command

$InactiveDays = 90
$Days = (Get-Date).Adddays(-($InactiveDays))
  

Get-ADUser -Filter {LastLogonTimeStamp -lt $Days -and enabled -eq $true} -SearchBase 'OU=SALES,DC=SHELLPRO,DC=LOCAL' -Properties LastLogonTimeStamp |
  
select-object Name,@{Name="Date"; Expression={[DateTime]::FromFileTime($_.lastLogonTimestamp).ToString('MM-dd-yyyy')}} | export-csv C:\inactive_Users.csv -notypeinformation

In the above PowerShell script to find inactive user accounts,

Get-ADUser filter parameter get ad users who has not logged in last 90 days and having status as Enabled.

SearchBase parameter specifies to get ad users from specific OU and pass output to the second command.

The second command, select Name and LastLogonTimeStamp of users and export inactive users to CSV file using Export-CSV cmdlet.

Inactive_Users.csv file contains information about inactive users in the active directory.

Cool Tip: How to export list of disabled users in PowerShell!

Conclusion

I hope the above article about get ad users not logged in for 30 days or find inactive users in the active directory is helpful to you.

Read more about on get-aduser blog posts where I explained to get-aduser by email, get aduser properties, get-aduser filter from specific ou

You can find more topics about PowerShell Active Directory commands and PowerShell basics on ShellGeek home page.

Leave a Comment