As a best practice, we have always been told to keep our Active Directory as clean as possible. There are many reasons to follow this simple rule. Stale user accounts which belong to employees who have leaved the company pose security risks to your network and allow malicious intruders to steal the credential and login and access your network. Additionally, obsolete Active Directory objects can clutter your Active Directory database and consequently makes the replication process time-consuming and bandwidth-wasting. Moreover, with the appearance of cloud-based directory services, the Microsoft version of which is called Azure Active Directory, whose price is directly affected by the number of AD objects, it is of paramount importance for big organizations to keep their Active Directory freshened up, using an AD clean-up tool.
What is the definition of Active Directory stale objects and how to remove them? Any Active Directory objects, including user, computer group, etc., which is not directly used by any employee or service, whether temporarily or permanently, must be carefully examined and considered for removing or disabling. Borna AD manager helps you find all unnecessary and stale AD objects, and take appropriate action. Furthermore, you can define automations to perform Active Directory clean-up periodically without taking any manual action.
A typical AD clean-up tool usually contains the following reports and features:
To see a list of all AD user reports, visit Active Directory Reports.
Report account with empty attributes (Account Expired Time)
In some cases, administrators or other employees to whom the responsibility of creating users is delegated neglect to fill account expiration time. Users without account expired time attributes can log in to their domain forever. Thus, administrators should constantly check Active Directory users to find the ones who are no longer allowed to log in. With Borna AD clean-up tool you can see a list of all users whose account expired attribute are empty and manage them, for instance you can set an expiration time for all of them simultaneously.
Automatic Clean-up Strategy
Clean-up process is a periodic and ongoing task. How to know it is the right time to start cleaning-up? How often should we clean up AD? It is really difficult to tell even in specific scenarios, let alone for the general case. Note that cleaning up is a cure. The best way to manage AD objects is to prevent unnecessary objects to exist at first place. Although sound unfamiliar, it is possible to define automatic tasks which handles these objects periodically without requiring administrators aim. To see how to define automation visit Active Directory Automation.