← All tutorials

Active Directory

Strengthen passwords and handle employees who leave

Set a sensible password policy, find unused accounts, and remove access safely when people leave.

Intermediate8 min read5 steps

  1. PolicySet the rules
  2. FindInactive accounts
  3. LeaversDisable and remove
  4. ReviewMake it routine

What you need

  • A working domain
  • PowerShell on the domain controller, opened as Administrator

  1. Check and set the password policy

    Long passwords protect better than complex short ones. Lockout limits slow down password guessing, though a very low limit can lock out real users. Adjust these values to your security needs.

    Get-ADDefaultDomainPasswordPolicy

Set-ADDefaultDomainPasswordPolicy -Identity "corp.example.com" `
  -MinPasswordLength 12 `
  -LockoutThreshold 10 `
  -LockoutDuration "00:15:00" `
  -LockoutObservationWindow "00:15:00"

  2. Find inactive accounts

    Old accounts are a common way into a network. Review this list with department managers rather than disabling everything automatically, because some service accounts rarely sign in.

    Search-ADAccount -AccountInactive -TimeSpan 90.00:00:00 -UsersOnly |
  Select-Object Name, SamAccountName, LastLogonDate

  3. Disable a leaver's account immediately

    Disable the account as soon as someone leaves, and record what you did. Check their group memberships first, so you know what access they had. Also change any shared passwords they knew.

    Get-ADPrincipalGroupMembership -Identity "rahim" | Select-Object Name
Disable-ADAccount -Identity "rahim"
Get-ADUser -Identity "rahim" | Select-Object Name, Enabled

  4. Move it and remove it later

    Move the account to a separate OU and remove it from its groups. Delete it later, after the period your company's data and legal rules require. Create the Disabled OU first.

    Remove-ADGroupMember -Identity "Finance" -Members "rahim" -Confirm:$false
Get-ADUser "rahim" | Move-ADObject -TargetPath "OU=Disabled,OU=Company,DC=corp,DC=example,DC=com"

  5. Add a second layer of protection

    Use multi-factor authentication for remote access and email, especially for administrators. Give administrators a separate admin account for admin work, and use a normal account for everyday email and browsing.

Want this set up for your business?

We can plan, build and hand it over to your team.

Discuss your setup ↗
Next tutorialAdd a second domain controller for reliability →