Stale user accounts in Active Directory are a significant security risk since they could be used by an attacker or a former employee to wreak havoc in your Windows environment. In addition to the security factor, these inactive accounts also consume reclaimable database space. These users should be regularly cleaned up as they pose a threat to the overall security of the environment.
The reasons why this practice is advocated by Microsoft and other security researchers are as follows:
- Newly provisioned user accounts tend to use the same password knowing the user will be forced to change the password on next logon. If the user account was never used, it can very well be compromised and used as an attack vector.
- Administrators also happen to group new accounts into the necessary groups while provisioning them. So, if the account is compromised, attackers will have access permissions granted based on the group membership.
- Since these stale accounts are not tracked actively, administrators will not know if and when the account is abused, leaving the network at a high risk of an attack.
Now that we have got our reasons out of the way, how do you find and remove such stale user accounts? Luckily, administrators can make use of PowerShell scripts to find out "never logged on" user accounts.
Script 1: import-module activedirectory
Get-ADUser -LDAPFilter "(&(&(objectCategory=person)(objectClass=user)(!isCriticalSystemObject=TRUE))(|(lastLogon=0)(!(lastLogon=*))))"
Script 2:
import-module activedirectoryget-aduser -Filter {-not (lastlogontimestamp -like "*") -and -not (iscriticalsystemobject -eq $true)}
Regular monitoring and cleanup of inactive and stale user accounts are necessary for the safety of the environment. You should carry out regular checks to look for any stale user accounts, and then disable and remove those accounts from Active Directory.