Discussion on:

Handling inactives in AD with NetWrix Inactive Users Tracker

That you do not need. If you are an active directory administrator you should know how to get the same information using LDAP queries or powershell. There are many ways to get this information for free without spending a dime. If you don't know how to do this, you are not qualified to administer active directory.

This kind of BOFH "Do it the hard way" attitude is something out of the stone-aged Unix big-iron days, and I'm surprised to see it among anyone who runs an Active Directory domain. The thing that generally seperates the *nix guys from the Win guys is that Win guys generally don't insist on bashing their head on the brick-wall if there is an easier way to do something.

There are lots of things that can be achieved, free, and often inefficiently, with the built in tools that Microsoft provides with their OS platforms, and it has been that way since NT 3.1.

But a smart Admin understands that there is nothing gained by being so egotistical that he or she insists on using arcane, complex, time consuming and unreliable bundled methods when there are superior, more efficient, more reliable commercial alternatives that exist.

Sometimes the built in tools are fine, and a lot will depend on your specific environment in a situation like this. I think it is foolhardy to rule this tool out because it is commercial. It exists because the built in tools for achieving these goals are not as robust or intuitive as they could be.

Coming from a long stint in retail before thankfully switching to IT, I learned over the years that new tools as well as new input from my staff can save a lot of time if it gives me what I need in a usable form quickly. At the same time, it never hurts to know the process so that if there is an issue you have the knowledge to be able to troubleshoot. Jumping from A to Z is great as long as somebody knows the rest of the alphabet in case the black board breaks.

Our initial testing with this product shows that it returns false positivies on user inactivity. We have maintenence accounts that have been used within the last month that showed as inactive for longer than that when running a report with this particular tool. Based on that, I'd recommend approaching this product with caution and testing it fully before relying on it.

We're still testing.

it's foolish to spend money on a third party product to accomplish a task that can be done for free very easy by scripting. Even if you know nothing about scripting, a google search brings up MANY!

The sign of a good leader is the ability to delegate responsibilities without negatively impacting productivity, efficiency and overall quality of output. I think similarly, the sign of a good IT administrator is the ability to delegate responsibilities using the best tools available in order to maximize quality and proficiency. Of course, there are several ways that IT administrators can go about detecting inactive users, a few of which are free, but I think it?s important for IT departments to understand that using commercial products instead of LDAP queries does not make them lazy? in many cases, it makes them smart. Writing and supporting scripts and LDAP queries takes time and resources, but with NetWrix Inactive Users Tracker, administrators can spend their time on other important tasks. Products like NetWrix Inactive Users Tracker allow administrators to manage their IT infrastructures in an automated and stress-free fashion, something that LDAP queries can?t offer. Additionally, for those of you who don?t see the need to buy commercial software in this instance, it?s worth noting that NetWrix does offer a free version of Inactive Users Tracker.
Stephen Schimmel
Product Manager
NetWrix Corporation
www.netwrix.com

AD administrators that use 3rd party tools to accomplish these tasks that are easily done with LDAP queries does not make them lazy. It makes/keeps them incompetent. What is a person doing in the role of an AD administrator if they do not know how to query active directory using LDAP commands and rely on 3rd party apps to do it for them? Obviously they failed the Microsoft exams related to Active Directory. As an AD administrator myself who has never relied on 3rd party tools to achieve these normal tasks for an AD Admin, it frustrates me to see those in the field using these tools to make up for their incompetence and lack of abilities. So when these AD administrators who rely on all these 3rd party tools to perform their AD tasks run into a real problem with AD and have to actually do some troubleshooting, what do they do? They have no clue what is happening "behind the scenes" and how AD works beings they've never been exposed to queries and actually working with the back end of AD. Or is there a 3rd party tool you sell for that too???

Using built in command line tools is fine in smaller environments or those that are not very dynamic. In larger enterprise environments the more automated tools you can use to your advantage the better. It's also very arrogant to assume that it's worth your employer's time to pay you to work on a script for a week to do something that a commercial application you can purchase for half your week's salary can do