SysFlint AD
Disabled Account Reports for Active Directory
Disabled accounts are the sediment of an Active Directory estate. Every leaver, every ended contract, every service account someone switched off "temporarily" settles into the directory and stays there. Auditors ask for the list, cleanup projects need the list, and most teams rebuild it by hand every single time.
How this is normally done
With RSAT installed, one line of PowerShell gets you the raw list. It is genuinely fine for a spot check:
Get-ADUser -Filter { Enabled -eq $false } -Properties LastLogonDate, whenCreated |
Select-Object Name, SamAccountName, LastLogonDate, whenCreated |
Sort-Object LastLogonDate |
Export-Csv -Path 'C:\Reports\DisabledUsers.csv' -NoTypeInformationWhere it stops being enough
- It is a snapshot. It cannot tell you whether an account was disabled last week or in 2019.
- Nothing runs it but you. A scheduled task means owning the credentials, the failure handling, and the silence when it stops working.
- The CSV needs cleaning before anyone outside IT will read it.
- Run it per domain in a multi-domain forest, then reconcile the results yourself.
What SysFlint AD does instead
The same discovery, run for you, kept over time, and delivered in a form you can hand to an auditor without editing it first.
- Every disabled user and computer account across the forest, in one report.
- Grouped by OU so you can see which parts of the estate are accumulating dead accounts.
- Dormancy in plain terms — "disabled, last used 412 days ago" — not a raw timestamp.
- History across runs, so a rising disabled-account count is visible instead of invisible.
- Exportable to CSV or PDF and schedulable to the inbox that needs it.
What's in the report
- Display name, SAM account name, and distinguished name
- Parent OU, so cleanup can be delegated per business unit
- Last logon date, with the replication-lag caveat handled for you
- Account creation date and time since last use
- Whether the disabled account still holds privileged group membership
Frequently asked questions
- Can it report on disabled computer accounts too?
- Yes. Computer objects follow the same lifecycle as user objects and are covered by the same report — decommissioned servers and retired laptops show up alongside disabled users.
- Why is last logon unreliable in PowerShell?
- LastLogonDate is a replicated attribute and can lag by up to roughly 14 days by default. The precise attribute, LastLogon, is not replicated, so an accurate answer means querying every domain controller and taking the maximum. SysFlint AD does that for you.
- Does it delete the accounts it finds?
- No. It is read-only by design. Deciding what to disable, move, or delete stays with you and your change process.
Related features
Related use cases
Get SysFlint AD
Free, forever. No license keys, no per-user pricing, no seat counts, no trial timer.