Active Directory: Never Used User Accounts Summary (With Exclusions)
submitted
M
Michael Thompson
This metric will list all accounts created over 30 days ago that have not been logged into. The metric also supports the RoarExclude group filter. The RoarExclude group filter will prevent alerts from triggering for users who are part of the RoarExclude group.
Users[?LastLogonDate==
null
&& DefaultSystemUser == false
&& Enabled == true
&& DaysSinceCreated >30
&& (contains(MemberOfStr, RoarExclude
) == false
|| !MemberOfStr)].join(`, [UserName,
, Created On:, Created]) | join(
| `, @)