**Table of Contents**  
**Overview**  
**Process**  
**Script**  
**Exceptions**  
**Logging**
   

## Overview

This document defines the process in which CBP has implemented automated processing to address the NIST Security control AC-2(3), for inactivity as it pertains to Microsoft Active Directory computer accounts.  
 
**AC-2(3) Defined:**  
Access Control procedures or other documentation that document the automatic disabling of inactive accounts after organization defined time period. A CBP custom script process performs this function for computer accounts in AD.
 
CBP has defined that inactive STANDARD computer accounts as:  
            Disabled after forty five (45) days of inactivity  
            Deleted after sixty (60) days of inactivity
 
## Process

A scheduled task is executed by automation using Orchestrator daily, view/configure using RunBook Designer:
 
**Runbook Location:** EDMED\Runbooks\Job Runbooks\EDMED\WSG\Active Directory\User Tasks\ Clean User Objects V2  
**Script:** D:\Data\Scripts\UserTasks\CleanUserObjects\ADUserCleanV2.1.ps1  
**Command line argument:** RUN (if no argument supplied runs in 'whatif' mode)  
**Log location**: Logs to subdirectory of the main script \Log\
 
This script is used to automate disable/delete user objects based on the last time they logged into AD, specifically the lastlogintimestamp attribute. The script can be run in 'whatif' mode (making no changes) unless you supply RUN as a command line argument. When you run with argument RUN the script will make changes. Examples:
 
& '.\ADUserCleanV2.1.ps1' # without RUN (or anything other than RUN) makes no changes, logs to screen and log file  
& '.\ADUserCleanV2.1.ps1' RUN # with RUN command argument it will make changes in AD if you have AD permission to do so!
 
The script checks each users's lastlogintimestamp using configurable thresholds found in the beginning of the script. When a user is at the delete threshold it is deleted and when at disable threshold it is disabled.
 
Orchestrator Details  
Account used by Orchestrator to make changes in AD and write to SQL: **AD\SVC-EDME-USER-CL**
 
Job Runbook  
_DETAILS_  
Computer: tnwg01a-v3824 (subject to change to cluster model vs. single server)  
Program Path: c:\windows\system32\WindowsPowerShell\v1.0\powershell.exe  
Parameters: D:\Data\Scripts\UserTasks\CleanUserObjects\ADUserCleanV2.1.ps1 RUN  
_ADVANCED_  
Run as Username (Orchestrator global settings variable): {SVC-EDME-USER-CLEAN}  
Password (Orchestrator global settings variable): {SVC-EDME-USER-CLEANPWD}
 
Scheduled Runbooks: References the above job runbook, runs daily at 8:12 PM (schedule is not significant)