PowerShell Script for Security Auditing of User Accounts

Security & AuditingJanuary 11, 2025

In this post, I will share a useful PowerShell script for auditing user accounts on a Windows system. This script checks for user accounts that have not logged in for a specified period, flags accounts that might be stale, and provides a report that can help system administrators maintain security by ensuring only active users have access.

powershell

$InactiveDays = 90
$DateThreshold = (Get-Date).AddDays(-$InactiveDays)

$UserAccounts = Get-LocalUser

$InactiveUsers = $UserAccounts | Where-Object {
    $_.LastLogon -lt $DateThreshold -or $_.LastLogon -eq $null
}

if ($InactiveUsers.Count -eq 0) {
    Write-Host 'No inactive user accounts found.'
} else {
    $InactiveUsers | Format-Table -Property Name, LastLogon
}

$ReportPath = 'InactiveUsersReport.csv'
$InactiveUsers | Export-Csv -Path $ReportPath -NoTypeInformation
Write-Host "Report exported to $ReportPath"

Run it across your fleet

This script runs as-is on a single host. Paste it into ServerEngine to schedule it, run it on a whole server group in parallel, and keep the credentials out of the file — see the scripts documentation and the credential store.

Ready when you are.

Try ServerEngine free for 7 days.

Get it on Microsoft Store

ISO 27001 aligned SOC 2 Type I aligned

PowerShell Script for Security Auditing of User Accounts

Run it across your fleet

More in Security & Auditing

Enable the Windows Firewall with PowerShell

Check Windows Firewall Status with PowerShell

Disable SMBv1 with PowerShell

Enforce TLS 1.2 in the Registry with PowerShell

Enable RDP Network Level Authentication with PowerShell

Audit the Local Administrators Group with PowerShell

Ready when you are.