Skip to content
Browse

/commands/active-directory/search-adaccount-inactive-accounts

Search-ADAccount: find inactive, disabled, expired and locked-out AD accounts

The commands on this page have not been executed by our verification runner yet.updated
tool
Active Directory PowerShell
versions
ActiveDirectory module (RSAT) on Windows 10/11 and Windows Server 2016+
os
windows

Search-ADAccount finds user, computer and service accounts by state without writing a filter. The most used form lists accounts that have not logged on for a period:

powershell
Import-Module ActiveDirectory
Search-ADAccount -AccountInactive -TimeSpan 90.00:00:00 -UsersOnly |
  Select-Object Name, SamAccountName, LastLogonDate, Enabled |
  Sort-Object LastLogonDate

-TimeSpan 90.00:00:00 means 90 days (days.hours:minutes:seconds); -DateTime '2026-07-01' uses a fixed cutoff instead. -UsersOnly or -ComputersOnly restricts the object type; without either, both are returned.

Switches

SwitchFinds
-AccountInactive -TimeSpan / -DateTimeaccounts whose last logon is older than the period (or that never logged on)
-AccountDisableddisabled accounts
-AccountExpiredaccounts past their expiration date
-AccountExpiring -TimeSpan 30.00:00:00accounts that expire within the period
-LockedOutaccounts currently locked out
-PasswordExpiredaccounts whose password has expired
-PasswordNeverExpiresaccounts with the password-never-expires flag

Common parameters: -SearchBase 'OU=Staff,DC=contoso,DC=com' to search one OU, -SearchScope OneLevel, -Server dc01.contoso.com, -ResultSetSize N.

Report, then act

powershell
$stale = Search-ADAccount -AccountInactive -TimeSpan 90.00:00:00 -UsersOnly |
  Where-Object Enabled
$stale | Select-Object Name, SamAccountName, LastLogonDate, DistinguishedName |
  Export-Csv stale-users.csv -NoTypeInformation
$stale | Disable-ADAccount -WhatIf

Review the CSV and the -WhatIf output before running the last line without -WhatIf. Service accounts, break-glass accounts and accounts used only through other systems (such as cloud-only sign-ins synchronised from AD) can look inactive and still be needed.

Unlock and check locked-out users

powershell
Search-ADAccount -LockedOut -UsersOnly | Select-Object Name, SamAccountName, LastLogonDate
Unlock-ADAccount -Identity jdoe

Sources

Related pages

flags · active-directoryGet-ADUser -Filter syntax: examples with -like, variables, dates and -PropertiesGet-ADUser -Filter takes a query string such as "Name -like 'Ann*'". Quote the values, add -Properties for extra attributes and use -SearchBase for one OU.commands · active-directoryGet-ADGroupMember -Recursive: list all members of an AD group, including nested groupsGet-ADGroupMember -Recursive returns every user and computer in a group and its nested groups. For groups over 5,000 members, use an LDAP filter instead.flags · powershellExport-Csv -NoTypeInformation: remove the #TYPE line from CSV filesWindows PowerShell 5.1 writes a #TYPE header as the first line of Export-Csv output unless you pass -NoTypeInformation. PowerShell 6+ omits it by default.commands · active-directorySet-ADAccountPassword -Reset: reset an Active Directory user password with PowerShellSet-ADAccountPassword -Identity USER -Reset -NewPassword (a SecureString) resets an AD password; Set-ADUser -ChangePasswordAtLogon $true forces a change.