Audit offboarding state
Documentation: Microsoft Learn — Get-ADUser
A single Get-ADUser call requests Enabled, MemberOf and LastLogonDate for the account named in $Sam.
The script
Script reader
Inspect before you run
Inspect the script below. It does not run in this browser.
Inspection only — no command has run.
Show reference output
Show reference output
Illustrative output for one fictional account
User : jsmith Enabled : False Groups : CN=Finance,OU=Groups,DC=example,DC=com LastLogon : 09/20/2026 08:30:00
Inspect this example’s structure
Read the command and its supplied arguments. This example requires real PowerShell or its module; this diagram does not execute it.
$Sam = "jsmith"
$u = Get-ADUser $Sam -Properties Enabled,MemberOf,LastLogonDate; [pscustomobject]@{User= $u.SamAccountName;Enabled= $u.Enabled;Groups=($u.MemberOf -join ";");LastLogon= $u.LastLogonDate}- Stage 1$Sam
Positional values or no named parameters
How it works
A single Get-ADUser call requests Enabled, MemberOf and LastLogonDate for the account named in $Sam. The [pscustomobject] literal then flattens MemberOf, which is an array of distinguished names, into one semicolon-delimited string so the whole snapshot fits a single CSV row.
Adapting it
Keep the full distinguished names when you need to identify groups unambiguously. If you need friendly names, resolve each group explicitly; splitting on commas can mishandle escaped characters in a distinguished name.
Requirements
Install the ActiveDirectory tools and use an account allowed to read the requested user properties. This read-only example reports on-premises AD; it does not inspect cloud sessions, mailboxes or devices.
If the result is unexpected
An offboarding report looks complete while access remains elsewhere.
Disabling one directory account does not verify mailbox, group, device and cloud-session state across systems.
- List the systems in scope and inspect each account identifier against its own authoritative service.
Validate the result
Check that User matches the account requested and inspect Enabled and Groups against your offboarding checklist. LastLogonDate is derived from a replicated timestamp and is not a precise record of the latest authentication. This snapshot alone does not prove that offboarding is complete.
Keep the check reliable
Maintain a system-specific offboarding checklist with ownership and evidence for each control.
