Active Directory: Clean up old user accounts

Active Directory (AD) is designed to manage millions of objects in a domain. But even if you use organizational units (OUs) Well, we humans can't handle too many objects properly. So, there's a way to keep the number of objects or, specifically, the number of user accounts that doesn't stack up there, that is, to do some cleanup work.

Cleanup is necessary for an account that your organization no longer needs. These are the accounts of employees who have not been employed (i.e. they should be abandoned or isolated). There are two ways to manage the old user account. One is that all accounts that were created in the domain should be retained in order to simplify future security checks. If you delete an account, the audit record will point to a non-existent record. The second idea is to delete the accounts of people who are no longer employed. In both cases there is something you can do to sort them out.

First, if you have to keep those accounts (that is, do not delete them), then first make sure that the account has been properly barred from its permissions. If you think this may not be enough, consider assigning a new complex password for these existing dead accounts. Finally, you may want to create a dedicated organizational unit and move all the inactive accounts into it. This can prevent the rest of your domain from being confused by keeping your account in the same place.

Second, even if you choose to delete a user account, the user overview file directory and the user account's home directory will usually be left behind. The operating system does not automatically delete these folders when the account is deleted. You can delete the user profile directory and home directory for any account that has been marked as deactivated. Doing so will clean up your server and free up a significant amount of drive space. But don't forget to check and read them first, to make sure that no important or valuable data is available. Once a file is deleted, unless it has a backup, then this deletion may be permanent.

You may have found that sometimes even administrators have difficulty deleting user profiles and root directories for normal user accounts. This annoying problem is usually resolved in the following way, first make sure you are a domain administrator, and then take ownership of the folder you are trying to delete before you try to delete the content. With a side note, be sure to take ownership of both folders and their contents. The operating system typically acknowledges user profile folders (or some content in a folder) and user account ownership of their home directories. Therefore, without ownership, even the administrator does not have sufficient permissions to handle those objects. Licensing issues can be ignored in the form of ownership by a user who has administrator rights, because the object owner has full control over that object.

So, with a little design, a little organized rescheduling and some hard drive space cleanup, you can keep your drives and AD databases cleaner.