Reporting on AD users

In the previous recipe, you created a report on computer accounts that may be of interest. User and group accounts are also worth tracking. If a user has not logged on for a reasonable period, the account could be a security risk. Likewise, a user with membership in a privileged account (for example, Enterprise Admins) could be used by an attacker. IT professionals know how much easier it is just to put someone in a high-privilege group than to set up more fine-grained permissions using something like Just Enough Administration (see the Implementing Just Enough Administration (JEA) recipe in Chapter 8, Implementing Enterprise Security).

Regular reporting can help focus on accounts that could be deactivated, removed from a security group, or removed altogether.

In this recipe, you obtain all the accounts in the AD and examine potential security risks.

Getting ready

You run this recipe on DC1, a DC in the Reskit.Org domain, after running the recipes...