Home / server / Questions / 117186
Accepted
Malnizzle
Asked: 2010-02-27 07:24:04 +0800 CST

What Defines an AD Object as "Inactive"

  • 772

I am going to be using some DSQUERY/DSMOVE scripts to clean up my AD Domin. One option is to move inactive objects to a OU that has restrictive GPOs applied to it.

Something like:

DSQUERY computer -inactive 10 | DSMOVE -newparent <distinguished name of target OU>

My question is what value defines an object, both user and computer, as "inactive" for a period of time? Is it the last time a computer was logged on to for computer accounts, and for users is it the last time that the user account logged on to a computer?

But what if, say for example, I had a web server that wasn't rebooted and or logged into for a couple of months but remain powered on and functioning as normal, would it be defined as "inactive" where as technically it's still serving web pages and so on?

Thanks for the help!

windows windows-server-2008 active-directory ldap

2 Answers

  1. Best Answer

    Well, if you run dsquery user /? it tells you this

    -inactive Finds users that have been inactive (not logged on) for at least number of weeks.

    For computers, it just says 'stale', so we can assume it's the same thing - amount of time since the domain has seen that computer account get authenticated.

    For your hypothetical, I'm sure a powered-on and well-connected computer would not show up as stale. There's things like GPO refresh and Kerberos timeouts that cause activity in the background, I'm sure those would refresh whatever 'stale' counter exists.

    • 1

  2. This attribute should be based on lastlogonTimestamp. See post from JOE (MVP)

    "http://technet.microsoft.com/en-us/library/cc725702(WS.10).aspx

    dsquery uses the lastLogonTimeStamp attribute. This attribute is only used in Windows Server 2003 DFL mode and is not up to the minute, it will be up to 7 days off by default.

    As for Exchange resource mailboxes. There is no guaranteed clean generic way of finding which ones are in use or not. In my real job, I am a high level consultant for a Messaging Services organization and all together our teams manage literally millions of mailboxes across many of the largest companies around the world. This is a problem we have looked for some time for a guaranteed solution and there isn't one. You may be able to find something that works locally if you understand how your resource mailboxes are being used... for instance you may be able to look at tracking logs and if no mail is coming in or going out that means they aren't being used. There is a logon attribute for mailboxes, but it gets updated by the local system when it is scanning through mailboxes with AV or other items and it is also updated when others view calendars or delegated folders.

    joe

    -- Joe Richards Microsoft MVP Windows Server Directory Services Author of O'Reilly Active Directory Third Edition www.joeware.net "

    • 1