How to Find Inactive Admins in Active Directory

Inactive admin accounts in Active Directory often result from role changes, employee departures, or temporary privileged access that is no longer required. When these accounts retain elevated privileges, they can pose significant security risks.

Key risks associated with inactive admin accounts include:

Identified an inactive admin account and wondering if it's still needed? Instead of immediately deleting the account, follow a quarantine-based offboarding approach. This involves disabling the account and isolating it in a dedicated quarantine OU while retaining it for review.

Keeping the account in quarantine for a period helps identify hidden dependencies such as applications, scheduled tasks, services, or administrative processes that may still rely on it. If any issues are reported after the account is disabled, you can quickly investigate and restore access if required. This approach helps organizations safely decommission dormant privileged accounts before permanent removal.

Disable the inactive admin account in Active Directory

Disabling an inactive admin account immediately blocks all sign-in attempts while preserving the account and its associated information.

• Open Active Directory Users and Computers (ADUC).
• Locate the inactive admin account, right-click the account, and select Disable Account.
• A down-arrow icon will appear, indicating that the account has been disabled.

To disable inactive admin accounts using a PowerShell, run the following cmdlet:

Disable-ADAccount -Identity "<User_DistinguishedName>"

Replace <User_DistinguishedName> with the distinguished name of the inactive admin account you want to disable.

Move the account to a quarantine OU in Active Directory

After disabling the account, move it to a dedicated quarantine OU. This OU can be configured with restrictive Group Policies to isolate inactive accounts from regular administrative and user environments.

• Open Active Directory Users and Computers and locate the inactive admin account in the respective OU.
• Right-click the disabled admin account and select Move.
• Choose the Quarantine OU (create one if not already available).
• Click OK to complete the move action.

To move inactive admin accounts to a quarantine OU using PowerShell, follow the steps below:

Move-ADObject -Identity "<DistinguishedUserName>" -TargetPath "OU=<OU_DistinguishedName>"

Replace <User_DistinguishedName> with the admin's distinguished name and <OU_DistinguishedName> with the path of the quarantine OU.

• With AdminDroid's Active Directory management actions, you can disable and move inactive admin accounts from a single centralized console.
• Simply select the inactive admin accounts, click Disable User to block access, and then use Move User action to relocate them to a designated quarantine OU.

Worried about accidental changes? Don't worry! With AdminDroid's built-in Undo option, you can revert both account disablements and OU moves in seconds.

Blocking complete account access by disabling account is the generally recommended approach. However, some organizations may need to temporarily retain inactive admin accounts instead of immediately disabling or deleting them. This is often required for dependency validation, application compatibility testing, service account verification, auditing, or emergency recovery scenarios.

In such cases, instead of immediately disabling or deleting the account, admins can use deny logon policies to restrict interactive sign-ins while keeping the account available for monitoring and administrative review.

Deny logon locally for inactive Active Directory admin accounts

Repeat the same steps for Deny log on through Remote Desktop Services to block Remote Desktop logons for inactive admin accounts.

After the policy is applied, inactive admins will be prevented from logging on locally while the accounts remain available for auditing and future reactivation if required.

Disabling an inactive admin account is only half the battle. Leaving disabled admins inside their privileged groups such as Domain Admins or Enterprise Admins creates a dangerous security blind spot. If the account is accidentally re-enabled or maliciously altered, it can immediately regain full domain-level privileges.

To eliminate this hidden privilege escalation path, revoking privileged group memberships for stale admin accounts is essential.

Remove inactive admin from highly privileged groups using ADUC

• Open Active Directory Users and Computers (ADUC) and locate the stale admin account.
• Right-click the account, select Properties, and navigate to the Member Of tab.
• Select all privileged groups assigned to the account using Ctrl + Select, then click Remove.
• Click Apply, then OK, to save your changes.

Bulk Remove Inactive Admins from All Privileged Groups Using PowerShell

$Users = Import-Csv "<Input_CSVFile>.csv" 
$PrivilegedGroups = Get-ADGroup -LDAPFilter "(adminCount=1)" | 
Select-Object -ExpandProperty DistinguishedName 
foreach ($User in $Users) { 
$ADUser = Get-ADUser $User.SamAccountName -Properties MemberOf -ErrorAction SilentlyContinue 
if ($ADUser) { 
foreach ($GroupDN in $ADUser.MemberOf) { 
if ($PrivilegedGroups -contains $GroupDN) { 
Remove-ADGroupMember -Identity $GroupDN -Members $ADUser -Confirm:$false 
Write-Host "$($ADUser.SamAccountName) removed from $(Get-ADGroup $GroupDN).Name" 
}}} 
else { 
Write-Host "User $($User.SamAccountName) not found" 
}}

The script identifies all privileged groups assigned to those inactive accounts and removes them from those groups.

Note: After removing an inactive admin account from privileged groups, review the account for any existing AdminSDHolder-protected ACLs that could continue to grant elevated permissions. So, ensure any residual elevated permissions are cleaned up as part of the remediation process.