How to find local legacy user accounts?

Question

System administration

Hello!
There is a terminal server with local accounts, there are a lot of them, which of them are relevant is not entirely clear.
The task is to find out when the last time you logged in under the account.
I didn't find anything by googling, maybe someone solved a similar problem, and knows the answer?

Answer 1

You can read the lastLogon user attributes through PowerShell.

$Computername = $env:COMPUTERNAME
$adsi = [ADSI]"WinNT://$Computername"
$Users = $adsi.Children  | where {$_.SchemaClassName  -eq 'user'}
$Users | % {
            $_ | Select Name, LastLogin
           }

The output will be like this
Name LastLogin
{Administrator} {03/18/2014 18:00:13}
{Guest}
I think this will be enough for you. Of course, you can write all this into an array and unload it into a table, but that's a completely different story.

Answer 2

#search for users who haven't logged in for more than 8 weeks
dsquery user -inactive 8 -disabled