Stale accounts in Active Directory: identifying them reliably and cleaning them up

Measuring inactivity: lastLogon or lastLogonTimestamp

The lastLogon attribute is accurate but not replicated: each domain controller holds its own value. The lastLogonTimestamp attribute is replicated, but it is only updated when the previous value is older than an interval of about 14 days (the default, slightly randomised). It can therefore lag reality by one to two weeks.

In practice, lastLogonTimestamp is more than enough to find accounts inactive for 90 days or longer. It simply should not be used to conclude that an account was not used last week.

Search-ADAccount -AccountInactive -TimeSpan 90.00:00:00 -UsersOnly |
  Where-Object Enabled |
  Select-Object SamAccountName, LastLogonDate, DistinguishedName

For computers, pwdLastSet is a useful complementary indicator: an active member machine changes its account password every 30 days by default.

Disable first, delete later

1. Disable the account and move it to a dedicated OU, recording the date and reason in the description.
2. Allow an observation period (for example 30 to 90 days) to surface a forgotten dependency.
3. Delete, ideally with the Active Directory Recycle Bin enabled so a full restore remains possible.

This avoids the classic incident: the payroll application that stops because its "inactive" service account was deleted.

Service accounts

A service account may never log on interactively and look inactive while it is in use, or the opposite. Before any action, identify its owner and purpose. It is also a chance to spot accounts flagged "password never expires" with a password unchanged for years, and to consider group Managed Service Accounts (gMSA) where the application supports them.

Keeping evidence for audits

Compliance frameworks generally require proof of regular access reviews. Keeping, for each campaign, the export of detected accounts, the decision taken and its date, and linking the process to HR leaver notifications, gives simple and verifiable evidence.

In short

• Use lastLogonTimestamp with a generous threshold (90 days or more).
• Disable, observe, then delete.
• Handle service accounts case by case, with a named owner.
• Document every campaign.