Opselith
POWERSHELL / ACTIVEDIRECTORY
FreeIntermediateRead-onlylow

Export inactive AD users

Find enabled Active Directory users without a recent replicated logon timestamp and export the review candidates to CSV with PowerShell.

Open in PowerShell Builder →Browse all scripts

Generated locally in your browser · Review before running · Opselith does not connect to your tenant

What this PowerShell script does

Finds enabled users without recent logon.

Requirements

  • Inactive days - Enter required value
  • CSV output path - Example: C:\Temp\report.csv

Environment

  • Module: ActiveDirectory
  • Permissions: Directory read access
  • Output: CSV report
  • Context: Windows host with RSAT
  • Risk: Low
Review before you run The script is generated locally. Test outside production first.
NEXT STEP

Ready to generate

Configure Export inactive AD users in the Builder, review the generated PowerShell and run it yourself in your own PowerShell session.

Configure this script →Open Builder
More about this script

Why use this template?

Use this free PowerShell script when you need to find enabled users without recent logon. It is generated locally and can be reviewed before you run it yourself in your own PowerShell session.

The template uses ActiveDirectory and requires Directory read access. Output: CSV report. Level: Intermediate. Action: Read-only. Risk: Low.

Review before running

The script is generated in your browser. Read it before you run it, and test it outside production first. “Read-only” describes the script itself; anything you add around it can still change data.

Generate the script

  1. Open the template in the PowerShell Builder.
  2. Enter the requested values and review the module, permissions, output and risk.
  3. Generate the script, read it carefully, and test it outside production before use.

The script is generated locally in your browser. Nothing needs to be uploaded to Opselith.

Generate Export inactive AD users →

How to use this result

Use this report to build a review queue of enabled Active Directory users whose replicated logon date is blank or older than the threshold you choose.

When this helps

  • Prepare an inactive-account review before disabling or removing old user accounts.
  • Create a CSV of enabled users that have not shown recent replicated logon activity.
  • Repeat the same inactivity threshold over time to compare the candidate population.

How to read the result

  • The script calculates a cutoff date from the number of inactive days you enter and includes enabled users with a blank or older LastLogonDate.
  • LastLogonDate is based on Active Directory lastLogonTimestamp replication and is intentionally approximate, not an exact last interactive sign-in time.

Things to check

  • A stale or blank LastLogonDate is a review signal, not proof that an account can safely be disabled or deleted.
  • Check service accounts, infrequent users, disconnected scenarios and other known exceptions with ownership evidence before changing an account.

What to do next: Review the oldest candidates with the account owner or HR source, then use a separate approved process for any disable or removal action.

Related tasks

Official references

Before you runModule, permissions, inputs, compatibility and script checks
OPS / SCRIPT DETAILS

Script details

Finds enabled users without recent logon. Review these details before generating or running the script.

reportingexportfinduserspermissionsinactive
Generated here. Run by you.Opselith does not connect to your tenant or run PowerShell. After generating, review the script and run it in your own PowerShell session.

What it works with

Module: ActiveDirectory

ActiveDirectory lets PowerShell work with on-premises Active Directory and is normally installed through Windows RSAT.

Context: Windows host with RSAT

Compatibility: Windows PowerShell 5.1 / ISE is recommended for ActiveDirectory templates.

Permissions and changes

Permissions: Directory read access

Risk: Low

Read-only: designed to collect information without intentionally changing the target environment.

Changes: Read-only. The script reads data and does not intentionally change the target environment.

Inputs

  • Inactive days - Enter required value (Required)
  • CSV output path - Example: C:\Temp\report.csv (Required)

What to expect

Output: CSV report

Expect a CSV file at the path you choose. Open it in Excel or another CSV viewer and review the rows.

Example: C:\Temp\report.csv

This template is in the Free library and is generated locally in your browser. Opselith does not run it; you review and run the script in your own PowerShell session.

Example use

Finds enabled users without recent logon.

Enter the required values in the Builder, review the generated script and confirm the output before running it.

Before you run: Make sure your account has Directory read access. Check that the ActiveDirectory PowerShell module is available and that you are using the supported PowerShell version. Review the generated script and output path, then test outside production first.
Script checksWhat has been verifiedQA reviewed
Static checksPassed
PSScriptAnalyzerPending
Real-world run testNot yet recorded
Last checkedNot yet recorded

Real-world run results are shown only after Opselith reviews and accepts a tester report.

Tester: report a result →
TEST STATUSWhat Opselith has checked

Last reviewed: 10 Sept 2026

PSScriptAnalyzer: Awaiting a release PSScriptAnalyzer gate that includes this script. No analyzer pass is claimed yet.

Pending or Not yet recorded means there is no accepted result on file yet. A passed analyzer check does not mean the script has been run in a real tenant.

PRACTICAL GUIDE

How to use this result

Use this report as a review queue for enabled accounts that may no longer be actively used, not as an automatic disable list.

When this helps

  • Prepare a stale-account review before disabling or removing access.
  • Compare inactivity candidates with HR, ownership or service-account context.
  • Create a repeatable CSV snapshot for periodic account-hygiene reviews.

How to read the result

  • LastLogonDate is based on replicated lastLogonTimestamp data, so it is intentionally approximate.
  • A blank or old timestamp is a reason to investigate the account, not proof that the account is safe to disable.

Things to check

  • Do not make lifecycle changes from this report alone; verify service accounts, break-glass accounts and known exceptions.
  • Choose an inactivity threshold that matches your organization rather than treating one number as universally correct.
What to do next: Review the oldest candidates first, validate business ownership, and only then use a separate approved process for any account changes.
NEXT IN THE LIBRARY

Scripts for similar admin tasks and Microsoft services.

Browse Active Directory PowerShell scripts →
POWERSHELLFind stale AD computersreporting · find · permissionsPOWERSHELLFind users without managerreporting · find · usersPOWERSHELLExport disabled AD usersreporting · export · users