Review inactive enabled AD accounts
Documentation: Microsoft Learn
Find enabled accounts with a recorded LastLogonDate older than 90 days, while keeping the limits of replicated logon data clear.
Example reviewed 1 October 2026 · Illustrative output · Not a live system check
The script
$Cutoff = (Get-Date).AddDays(-90)
Get-ADUser -Filter 'Enabled -eq $true' -Properties LastLogonDate -ErrorAction Stop |
Where-Object { $_.LastLogonDate -and $_.LastLogonDate -lt $Cutoff } |
Select-Object SamAccountName, Name, LastLogonDateScript reader
Inspect before you run
Inspect the script below. It does not run in this browser.
Inspection only — no command has run.
Show reference output
Fictional reference snapshot · 03 October 2026, 09:00 UTC. This is an example result, not a check of your systems.
SamAccountName Name LastLogonDate -------------- ---- ------------- legacy01 Demo Operator 15/05/2026 09:00:00
Inspect this example’s structure
Read the command and its supplied arguments. This example requires real PowerShell or its module; this diagram does not execute it.
$Cutoff = (Get-Date).AddDays(-90)
Get-ADUser -Filter 'Enabled -eq $true' -Properties LastLogonDate -ErrorAction Stop |
Where-Object { $_.LastLogonDate -and $_.LastLogonDate -lt $Cutoff } |
Select-Object SamAccountName, Name, LastLogonDate- Stage 1$Cutoff
Positional values or no named parameters - Stage 2Where-Object
Positional values or no named parameters - Stage 3Select-Object
Positional values or no named parameters
Illustrative output
This example shows the expected shape for fictional data. Your values and formatting will differ.
SamAccountName Name LastLogonDate jdoe Jane Doe 2026-05-14 09:12:00
How it works
The query asks for LastLogonDate explicitly, excludes missing timestamps and compares recorded dates with a rolling cutoff. The fictional row shown qualifies when the example is evaluated on 1 October 2026; live results depend on the current date.
Before you run it
Use the ActiveDirectory module and read access. LastLogonDate is derived from replicated lastLogonTimestamp and can lag recent activity. Accounts without a recorded value are excluded and need a separate review.
Check the result
Confirm ownership and activity using appropriate evidence before disabling anything. For exact lastLogon investigations, understand its per-controller, non-replicated behaviour. An old timestamp alone does not establish abandonment.
If nothing is returned
No enabled account with a nonempty timestamp matched the cutoff in the returned scope. Never-logged-on accounts are not included by this filter.