Finding unused and disabled accounts
You separate disabled accounts, turn Windows time stamps (FILETIME) into dates, compute a threshold from the audit date and find people and computers that haven’t logged on for a long time, accounts that never logged on and passwords unchanged for years; at the end you find the account disabled this morning, an expired account that looks open, and write the clean-up plan yourself.
Level 201 · 50 min
Audit date: 12 March 2026. According to HR’s list the company employs 22 people, but the domain holds many more accounts. What are the extras? People who left, interns, test accounts, forgotten services…
An unused account is ideal for an attacker: its password is old and weak, its owner doesn’t complain, nobody notices it logging on. That is why every audit asks "who hasn’t been seen for a long time?".
AD keeps times as FILETIME: the number of 100-nanosecond steps since 1 January 1601. You see a number like 134175744000000000; in this lesson you learn to turn it into a date and back. The figure shows the calculation step by step.
This lab’s own changes are made in the background; 30 seconds after the lab starts everything is in place.
What you will do in this lesson
- Disabled accounts
- Turn a FILETIME into a date
- The other way: a 90-day threshold
- People not seen for 90 days
- Accounts that never logged on
- Passwords unchanged for years
- Computers not seen
- The account disabled this morning
- An expired account that looks open
- The clean-up plan
- Short quiz
Skills you will earn
- Finding disabled accounts and their last changes
- Converting Windows FILETIME values to dates
- Finding accounts and computers that haven’t logged on for long
- Finding passwords unchanged for years (pwdLastSet)
- Finding expired accounts (accountExpires)
- Writing audit findings into a report
← Privileged groups: Domain Admins, Enterprise Admins, Backup Operators · Active Directory security: auditing and hardening · Service accounts and passwords that never expire →
Start for free