Unused windows accounts

[Bud Guy]

What do you use to find unused windows computer and user accounts in active directory?

I've found a program called Unused Account Ferret that allows you to define variables for your search, like when the last logon was for users or computers. The program works great, but I'm looking for a free way to do this.

Any ideas?

 

[stash]

See my reply to this thread:

http://forums.anandtech.com/messageview...atid=34&threadid=1692635&enterthread=y

 

[Bud Guy]

Right on man! Exactally what I was looking for! This is what makes AT so nice!

Now, since you seem to be in the know about dsquery and dsget, how would I combine the two to do these two things at once...

1: show the users of a specified group.. say "accounting"
And
2: pull the users email addy's.

The domian would be temp.cary.im.com

Thanks man!

 

[Bud Guy]

ok, I think I've got it working to an extent.

C:\>dsget group CN=Accounting,OU=Finance,DC=temp,DC=cary,DC=im,DC=com -members -expand | dsget user -email

This gets me exactally what I want, but I've run into another issue. I get errors when I try to burrow into nested OU's.

Example:
C:\>dsget group "CN=Accounting,OU=Finance,OU=Finance Managers,DC=temp,DC=cary,DC=im,DC=com" -members -expand | dsget user -email

The OU structure is a top level of Finance, then Finance Managers, then the group name of Accounting.

I'm sure that I've done something, simple very wrong.

Does this make sense?

 

[stash]

You have your LDAP syntax slightly backward. If Finance is the parent, and Finance Managers is the child OU, it should be:

"CN=Accounting,OU=Finance Managers,OU=Finance,dc=....."

 

[Bud Guy]

YOU ARE THE MAN!

I can't tell you how many ways I screwed up the syntax. I must have gotten every possible combination of syntax errors before you set me straight!

I owe you a beer!
Thanks,
Shane