What is the criteria for an inactive User account?

Question

I know it is based on an attribute held in adaxes. What info does adaxes look at to determine the date? Just want to understand how the cake is baked.

Answer 1

Hello,

To check if a user or computer is inactive the Last-Logon-Timestamp / Last Logon, When Created and Password Last Set properties are used. In case the If is inactive <period> condition is set to, for example, more than 14 weeks, for a computer, Adaxes will check the computer if its Last-Logon-Timestamp / Last Logon and Password Last Set are older than 14 weeks. The When Created property is used to make sure that users created less than the specified number of weeks ago are not counted.

Comments

Thank you for the fast response.

---

In hybrid AD, the last sign in to AD doesnt seem that useful on its own? Dont we want to see the last sign in to either AAD or AD? Of is the lastlogon time stamp synced in hybrid AD?

---

Hello,

In hybrid AD, the last sign in to AD doesnt seem that useful on its own?

Yes, that is correct as the property is not replicated among domain controllers.

Dont we want to see the last sign in to either AAD or AD?

The above response is only for on-premises AD as Adaxes did not have the feature for managing AAD by that time.

Of is the lastlogon time stamp synced in hybrid AD?

The property is not synchronized and thus account activity should be checked separately in on-premises AD and in Azure AD.