Return
-
Title
New Accounts Are Disabled As Inactive Accounts By The Inactive Accounts Module. -
Description
The disable inactive users module is also disabling new accounts. For example, if this module is setup to disable only accounts that have been inactive for 190 days, but if new user accounts are created and if this module runs to search for inactive accounts it will disable these new accounts. Also it was noticed the following:1- In the preview screen, accounts display under Last logon date column 12/31/1600 6:00:00 PM, but if you look the object in AD it shows LastLogonTimestamp attribute as <not set>.2- Once the task run and disables users, the Last Logon Date appears to show correctly, but User objects are being moved to the Computer section along with disabled computer objects when they are supposed to be under the Users section under Inactive Users & Computer History. -
Cause
The issue is the last login date assigned to a user upon creation. This is set to the default start of epoch for AD which is January 1, 1601. As a result when we are comparing the last active date for the user to the current date the new accounts show as being inactive for a very long time. -
Resolution
WORKAROUND
None.
Defect ID # VSTS000368845 has been created to correct this issue in a future version of Active Administrator.
We are currently correcting this for Active Administrator to look at the creation date vs the current date to determine if a user is inactive if the last logon date shows as the start of epoch. This would prevent new accounts being marked as inactive in the future until the account is old enough, and unused for long enough, to pass the inactive date window.
-
Defect ID
VSTS000368845