WIN-012 · Script

Local Account Review

Reports local user accounts, flags ones that look inactive or risky, and can disable inactive accounts.

What it does

Lists every local user account on the device with its enabled state, last sign-in, password age, password settings and whether it is a member of the local Administrators group. An account is flagged as inactive when it is enabled and its last sign-in is older than -InactiveDays. Enabled accounts that have never signed in are flagged separately. Other flags: password never expires, password not required, and local admin membership.

Report mode (default) changes nothing and saves a CSV to -ReportDir. Disable mode turns off the flagged inactive accounts (and never-signed-in accounts when -IncludeNeverSignedIn is set) and saves a rollback CSV. It never disables the built-in Guest, DefaultAccount or WDAGUtilityAccount system accounts, the built-in Administrator account, any account in -ExcludeUsers, or the last enabled local administrator account. Accounts are disabled, not deleted. Domain controllers have no local accounts and are skipped. Runs silently as SYSTEM from any RMM or Intune. No prompts.

Requirements

Windows PowerShell 5.1+, run as SYSTEM or local admin

How to run it

• Run as: SYSTEM or a local administrator
• Run from: any RMM or MDM, Intune, a Group Policy startup script, a scheduled task, or an elevated PowerShell window
• Script type: PowerShell, 64-bit
• User interaction: none; the script never prompts
• Timeout: 10 minutes (30 for Windows Update installs)

Settings

Exit codes

• 0 = No inactive accounts found, or all flagged accounts disabled
• 1 = Inactive accounts found (Report), or some could not be disabled
• 2 = Script error

Testing steps

1. Run it first with the mode set to Report on one test device. Nothing is changed in that mode.
2. Read the log and confirm the planned changes are what you expect.
3. Run your chosen settings on the same test target and confirm the result.
4. Check the exit code: 0 = OK, 1 = needs attention, 2 = error (see log), 9 = this copy is past its Valid until date.
5. Roll out to a small group next, then everyone.

Rollback steps

Each disabled account is listed in the rollback CSV in the report folder. Turn it back on with Enable-LocalUser -SID <SID> (the exact command is in the Undo column). Accounts are never deleted.

Version and change log