How to Find Inactive User Accounts in Active Directory (PowerShell Script)

Get-ADUser -Filter {Enabled -eq $true} -Properties LastLogonDate |
    Where-Object { -not $_.LastLogonDate -or $_.LastLogonDate -lt (Get-Date).AddDays(-90) }

#requires -Modules ActiveDirectory
<#
.SYNOPSIS
    Lists Active Directory user accounts that haven't logged on recently.

.DESCRIPTION
    Queries Active Directory for enabled user accounts whose LastLogonDate is
    older than the given threshold (or who have never logged on at all),
    optionally scoped to an OU, and optionally exporting the results to CSV.
    LastLogonDate is a replicated attribute and can lag the true last logon
    by up to the domain's replication interval — good enough for a stale-
    account cleanup pass, not for security-incident-grade precision. Uses the
    current logged-on user's credentials — run it from a domain-joined
    machine with RSAT installed.

.PARAMETER Days
    Flag users who haven't logged on in at least this many days. Defaults to 90.

.PARAMETER SearchBase
    Distinguished name of the OU to search (e.g. "OU=Sales,DC=contoso,DC=com").
    If omitted, searches the entire domain.

.PARAMETER OutputCsv
    Path to a CSV file to export the results to. If omitted, results are only
    written to the console.

.EXAMPLE
    .\Find-InactiveADUsers.ps1

    Lists enabled users who haven't logged on in 90+ days.

.EXAMPLE
    .\Find-InactiveADUsers.ps1 -Days 30 -SearchBase "OU=Contractors,DC=contoso,DC=com"

    Lists enabled users in the Contractors OU who haven't logged on in 30+ days.
#>

[CmdletBinding()]
param(
    [int]$Days = 90,

    [string]$SearchBase,

    [string]$OutputCsv
)

Import-Module ActiveDirectory -ErrorAction Stop

$cutoff = (Get-Date).AddDays(-$Days)

$params = @{
    Filter     = { Enabled -eq $true }
    Properties = @('LastLogonDate', 'DistinguishedName')
}
if ($SearchBase) {
    $params['SearchBase'] = $SearchBase
}

$inactiveUsers = Get-ADUser @params |
    Where-Object { -not $_.LastLogonDate -or $_.LastLogonDate -lt $cutoff } |
    Select-Object Name, SamAccountName, LastLogonDate, DistinguishedName |
    Sort-Object @{Expression = { $_.LastLogonDate } }

if (-not $inactiveUsers) {
    Write-Host "No inactive user accounts found (threshold: $Days days)." -ForegroundColor Yellow
    return
}

Write-Host "Found $(@($inactiveUsers).Count) inactive user account(s) (no logon in $Days+ days)." -ForegroundColor Cyan
$inactiveUsers | Format-Table Name, SamAccountName, LastLogonDate, DistinguishedName -AutoSize

if ($OutputCsv) {
    $inactiveUsers | Export-Csv -Path $OutputCsv -NoTypeInformation
    Write-Host "Exported results to $OutputCsv" -ForegroundColor Green
}