Labs / Active Directory, defender view
Enabled admins nobody uses
Filter a user export with awk to find enabled privileged accounts whose passwords never expire and that have not logged on in over a year, the kind attackers love to borrow.
Briefing
An old admin account with a password set years ago is valuable to an intruder: nobody notices it logging on, and its password may be in an old breach. The export below was produced with Get-ADUser on Mar 14, 2026.
adminCount 1 marks accounts that are, or once were, in a protected group. awk -F, lets you filter on columns.
admin-ws · Active Directory, defender view
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.