← script library

User Account Status Reporting Script

Monitoring & HealthJanuary 13, 2025

This PowerShell script generates a report on user account status within Active Directory. It helps system administrators quickly identify locked accounts, accounts that have expired, and users who have been inactive for a specified period. This aids in maintaining security and compliance within an organization.

powershell
Import-Module ActiveDirectory

$inactiveDaysThreshold = 90
$cutoffDate = (Get-Date).AddDays(-$inactiveDaysThreshold)

$users = Get-ADUser -Filter * -Properties LockedOut, AccountExpirationDate, LastLogonDate
$filteredUsers = $users | Where-Object {
    ($_."LockedOut" -eq $true) -or
    ($_.AccountExpirationDate -ne $null -and $_.AccountExpirationDate -lt (Get-Date)) -or
    ($_.LastLogonDate -lt $cutoffDate -and $_.LastLogonDate -ne $null)
}

$reportPath = "C:\UserAccountStatusReport.csv"
$filteredUsers | Select-Object Name, LockedOut, AccountExpirationDate, LastLogonDate | Export-Csv -Path $reportPath -NoTypeInformation

Write-Host "User account status report generated successfully at $reportPath"

Run it across your fleet

This script runs as-is on a single host. Paste it into ServerEngine to schedule it, run it on a whole server group in parallel, and keep the credentials out of the file — see the scripts documentation and the credential store.

Ready when you are.

Try ServerEngine free for 7 days.