Checking when Active Directory users logged on last should not be the only criteria if you want to pinpoint stale user accounts reliably. Another method that can help with this judgement involves analyzing when user accounts had their password changed. Indeed, in a well managed Active Directory…
One way to detect inactive user accounts is to examine when was the last time they logged on to the Active Directory domain. Without further ado, let’s look at the PowerShell snippet that returns all user accounts in the domain…
Finding Active Directory groups that have not been changed in a long time can reveal other candidates for thorough inspection and possible clean up. Indeed, if a group has not been changed it means that nobody was added or removed…
One way of getting rid of excessive groups is to find which groups have similar membership. The simplest case is when the list of direct members of a group matches another group’s list. Groups with same direct members are not…
This time we will see how we can uncover another type of toxic and potentially unnecessary Active Directory objects – circular nested groups. First let’s define what circular nested groups are. These are groups that include themselves by a virtue of…
In this post we’ll explore how to discover empty groups in Active Directory. Empty groups are groups that have no members. Obviously, if this condition does not change for a while you might want to consider deleting those groups. First,…
