Automate User Account Auditing in Active Directory with PowerShell

Active DirectoryDecember 24, 2024

In this post, we will present a PowerShell script to automate user account auditing in Active Directory. Regularly auditing user accounts is essential for maintaining security and compliance within an organization. This script retrieves important details for all user accounts, including last logon times and account status, helping administrators identify inactive or potentially compromised accounts quickly. Here is the PowerShell script for auditing user accounts in Active Directory:

powershell

# Import the Active Directory module
Import-Module ActiveDirectory
# Retrieve all user accounts
$users = Get-ADUser -Filter * -Property DisplayName, LastLogonDate, Enabled
# Create a report array
$auditReport = @()
foreach ($user in $users) {
    $auditReport += [PSCustomObject]@{
        DisplayName   = $user.DisplayName
        LastLogonDate = $user.LastLogonDate
        AccountStatus = if ($user.Enabled) { "Enabled" } else { "Disabled" }
    }
}
# Output the audit report
$auditReport | Sort-Object LastLogonDate | Format-Table -AutoSize
Write-Host "User account auditing completed successfully."

Run it across your fleet

This script runs as-is on a single host. Paste it into ServerEngine to schedule it, run it on a whole server group in parallel, and keep the credentials out of the file — see the scripts documentation and the credential store.

Ready when you are.

Try ServerEngine free for 7 days.

Get it on Microsoft Store

ISO 27001 aligned SOC 2 Type I aligned

Automate User Account Auditing in Active Directory with PowerShell

Run it across your fleet

More in Active Directory

Active Directory User Onboarding with PowerShell

Active Directory User Offboarding with PowerShell

Disable an Active Directory User with PowerShell

Enable an Active Directory User with PowerShell

Unlock an Active Directory Account with PowerShell

Reset an Active Directory Password with PowerShell

Ready when you are.