Windows Forum

Ask something
Discussion Locked

User Stats dump

0 helpful
8 replies

by a former member

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I've a requirement to clean up old NT accounts that haven't been logged into for a set period of time. I've run uststat.exe from the resource kit which does give the last logon time, but unfortunately interrogates the PDC & each BDC separately. In my case this gives me 6 different cases for each user (>2000 users). Not too helpful. Does anyone know of a utility that will merge these automatically leaving the last logon time only?

Alternatively, if I pull the usrstat.exe output file into excel, can anyone give me a macro that will do the same thing? Even just to change the username to xxxx if logon date > a certain date? This would then leave me with the required info.

Cheers.

8 replies

by timthetoolman

Hi,

I must admit that I've never seen the format from the output of the uststat.exe but it seems to me that if you imported into Excel, then you should be able to sort on that date field.

Then you should simply be able to take all the usernames from the "top of the list".

Do that for each domain controller, merge the lists and do it one final time for the final "clean up these usernames" list.

Cheers,
Tim.

by shanghai sam

Thanks for the answer, but it doesn't cut down on the manual workload much. As I said, every user will appear 6 times with various dates. The firewall configs have changed a number of times over the last 12 months, so some users' last logon on some servers will be months ago & some won't have authenticated on others at all. So eliminating recent logons from the 6 servers & remerging the list will still leave me with multiple entries for 2000 users. What I then need to sort out is every user that appears 6 times hasn't logged on in the required timeframe.

Does this make sense?

by shanghai sam

Cheers for the Hyena link. I have seen it before & the first user dump I got was using a vbscript which queries the PDC for last logons - which I presume is what Hyena does. The problem here is incorrect data is being obtained - for instance doing acouple of spot checks I have noticed a user may have logged on more recently on a BDC which neither Hyena or the script picked up! Is this normal behaviour in the case of how NT operates - ie the BDC not updating the PDC on logon times,(very shoddy if it is) or is it to do with the firewall config in my case?

by timthetoolman

Hi,

OK.... having thought about it... how about this?

Dump into Excel
Sort by date
Remove the ones that have logged in recently and keep them.
Sort the rest.
Remove duplicates leaving you a sorted list of all potentially "old" accounts. Basically if they dont make it onto the "Recently logged on list" kept from above then they're out.
Then...
Remove duplicates from the "Logged in recently" list
Sort it
Line the two lists up side by side in Excel and manually scan down the list looking for the spots where the lists go out of synch. They're the "Haven't logged in recently" accounts.

Save off those names (for later deletion script writing...) and shift the list down a bit so it lines up again.

Cheers,
Tim.

by timthetoolman

...and I believe that should be shift the list "up" a little which makes it easier...

You'll be removing all the names from the longer "old accounts" list until the "Recently logged on" list matches it or is maybe bigger...

by Former member

Hi Tim, thanks for your thoughts again. It doesn't really help me much however because I still have to "manually" remove the duplicate names. I should have closed the call as I got a work collegue to write an Access query which does the job.

Thanks again.
Ter.

by Former member

This question was closed by the author

This discussion is closed to new replies.