Hello,
Thank you for specifying. The approach involves requesting the mailbox Last logon date/time for each user. To get the date/time, the mailbox parameters must be requested. This operation is time-consuming even in on-premises Exchange. Generating the report that requests the mailbox Last logon date/time for each user will take a significant time, making the report useless. As such, we suggest a slightly different approach where the mailbox Last logon date/time is saved to a custom date attribute and then used in the report. To save the mailbox Last logon date/time, create a scheduled task configured for the User object type. The task will check whether the user has an Exchange mailbox. If the condition is met, the below PowerShell script will be executed. The script saves the mailbox Last logon date/time to a custom date attribute whose schema name is specified in the $dateAttributeName variable.
Finally, the task configuration should look like this:
$dateAttributeName = "adm-CustomAttributeDate1" #TODO: modify me
# Get last logon date from Exchange
$mailboxParams = $Context.TargetObject.GetMailParameters()
$lastLogonDate = $mailboxParams.UsageInfo.LastLogonDate
if ($lastLogonDate -eq [DateTime]::MinValue)
{
$lastLogonDate = $NULL
}
# Update the user
$Context.TargetObject.Put($dateAttributeName, $lastLogonDate)
$Context.TargetObject.SetInfo()
Then modify the Inactive users built-in report or copy it and modify the new report. In the report configuration, replace the script used to generate the report with the one below. In the script, the $mailboxLastLogonDatePropertyName variable specifies the schema name of the custom date attribute used to store the mailbox Last logon date/time. Must be the same as the value of the $dateAttributeName variable in the script executed by the scheduled task.
$mailboxLastLogonDatePropertyName = "adm-CustomAttributeDate1" #TODO: modify me
# Get parameter values
$days = $Context.GetParameterValue("param-Days")
$highlight = $Context.GetParameterValue("param-Highlight") -eq "1"
# To highlight users who can log in, we need account options and the account expiration date
if ($highlight)
{
$Context.DirectorySearcher.SearchParameters.PropertiesToLoad.AddRange(@(
"userAccountControl", "accountExpires"))
}
# Set search criteria
$threshold = (Get-Date).AddDays(- $days)
$criteria = New-AdmCriteria "user" {(mailboxType -ne "shared") -and (whenCreated -lt $threshold) -and ((lastLogonTimestamp -empty $True) -or (lastLogonTimestamp -eq "unspecified") -or (lastLogonTimestamp -lt $threshold)) -and ((lastLogon -empty $True) -or (lastLogon -eq "unspecified") -or (lastLogon -lt $threshold)) -and ((pwdLastSet -eq "unspecified") -or (pwdLastSet -lt $threshold))}
$Context.DirectorySearcher.AddCriteria($criteria)
# Build the report
try
{
$searchIterator = $Context.DirectorySearcher.ExecuteSearch()
while ($Context.MoveNext($searchIterator))
{
$searchResult = $searchIterator.Current
$user = $Context.BindToObjectBySearchResult($searchResult)
# Check mailbox last logon date
$mailboxLastLogonDate = $user.GetPropertyValue($mailboxLastLogonDatePropertyName)
if($mailboxLastLogonDate -ge $threshold)
{
continue
}
# Check Active Directory and Entra ID for most recent activity
$inactivityDuration = $user.GetPropertyValue("adm-InactivityDuration")
if($inactivityDuration -lt $days)
{
continue
}
# Highlight users who can log in
$itemStyle = $NULL
if ($highlight -and
-not $Context.IsAccountDisabled($searchResult) -and
-not $Context.IsAccountExpired($searchResult))
{
# Create a style for highlighted objects
if (-not $styleHighlighted)
{
$styleHighlighted = $Context.Items.CreateItemStyle($NULL, "#f5f7de",
"ADM_LISTITEMFONTSTYLE_REGULAR")
}
$itemStyle = $styleHighlighted
}
$Context.Items.Add($searchResult, $NULL, $itemStyle)
}
}
finally
{
if ($searchIterator) { $searchIterator.Dispose() }
}